Phishing is one of the most common and most successful ways to attack people online. And it has come a long way since the old Nigerian-prince fairy tale. Today's phishing emails use clean language, sound plausible, and look polished. These seven tips help consumers and small businesses avoid falling for them.
Why Phishing Is So Dangerous
Phishing does not exploit technical flaws. It plays on human feelings: urgency, fear, authority, and trust. Say you are in a rush, open what looks like a DHL notice, or check an invoice. Then you often notice the trick too late. On top of that come AI-written messages, login pages that look exactly like the real ones, and QR-code attacks (quishing).
The Seven Tips
- Check the sender: Don't trust the display name alone. Look at the actual email address. Small letter swaps, wrong TLDs, or odd subdomains are clear warning signs.
- Check links before you click: Hover over a link without clicking. Does the target match the text you see? If in doubt, type the site address into your browser yourself.
- Never send sensitive data by email: Banks, payment providers, and public bodies do not ask for passwords, TANs, or PINs by email. If a message does, it is almost surely fake.
- Keep your software up to date: Update your operating system, browser, email app, and antivirus on a regular basis. For firms, EDR solutions help spot suspicious activity.
- Take care on public Wi-Fi: Don't do online banking or other sensitive logins on open networks. A trusted VPN makes attacks much harder.
- Use strong passwords and multi-factor authentication: Use a password manager for long, unique passwords. Turn on MFA wherever you can. Then even a stolen password is of no use to an attacker.
- Stay alert on social media: Attackers use friend requests, direct messages, and fake giveaways more and more. Stay skeptical. If in doubt, check through a second channel.
Quick Phishing Checklist
- A message you did not expect (invoice, parcel, locked account, tax refund).
- Fake urgency ("reply within 24 hours").
- An odd sender address or an unknown domain.
- Links that don't match the company that claims to write.
- Attachments in odd formats (e.g. .html, .iso, .zip with scripts).
- A generic greeting ("Dear customer").
What to Do If You Fell for It
- Change the affected passwords right away. Do this on every service where you use the same password.
- If you entered bank details, tell your bank and block your cards.
- Scan the device with up-to-date security software.
- Write down what happened and report it (police, consumer protection, internal IT).
- At work, start the incident response process.
Conclusion
No filter and no tool catches everything. People remain the last line of defense. Take these seven rules to heart. When in doubt, ask one question too many rather than one too few. That way you cut your phishing risk sharply. Firms should add a structured awareness program and regular phishing tests. Trained eyes spot attacks before they do harm.