How to Recognize Phishing Emails, Sites and Messages
Basics4 minInnovialabs editorial team
In short
Phishing almost always gives itself away with urgency, a link or attachment you must open right now and an address that only looks like the real one. One rule covers most cases: do not follow the link in the message — open the service yourself or call a number you already know.
Spotting phishing in ten seconds
Phishing is an attempt to get your password, SMS code or card details, or to make you install malware, by pretending to be someone you trust: a bank, a government service, a delivery company, a colleague or a friend.
Ask yourself three questions:
- Am I being rushed? "Your account will be blocked in an hour", "Confirm this payment now", "Last chance to claim your payout".
- Am I asked to act through a link or file? Log in, confirm, download, enter a code.
- Is the address definitely genuine? Not the display name — the actual email address, the link's domain, the phone number.
If the answer to the first two is yes, check the third with extra care. Better still, skip the check and open the service on your own.
Sender address
The display name in an email can be anything. Look at the full address:
support@bank-example.cominstead ofsupport@bank.example— a different domain;noreply@example.com.secure-login.net— the real domain here issecure-login.net; everything before it is just a subdomain;- a free mailbox (
bank.support2024@gmail.com) claiming to be an organization; - the Reply-To address differs from the From address.
An email from someone you know can still be phishing if their mailbox was compromised. An unexpected request to "pay this invoice urgently" or "review this document" is a reason to call them and check.
Links and lookalike domains
Before clicking, hover over the link (long-press on a phone) and read the address. Signs of a fake:
| Trick | Example |
|---|---|
| Similar characters | rn instead of m, 0 instead of o, l instead of I |
| Extra words in the domain | example-secure.com, example-bonus.uz |
| Different top-level domain | example.co instead of example.com |
| Real name in a subdomain | example.com.verify-account.top |
| Characters from other alphabets | a Cyrillic "а" in place of a Latin "a" |
| Shortened links | a short URL hides the real destination |
The padlock in the address bar proves nothing: a scam site can get an HTTPS certificate for free. It only means the connection is encrypted, not who owns the site.
The most reliable defence is bookmarks and official apps. Open your bank or email from a bookmark, never from a message.
Attachments
Dangerous attachments include:
- executable files:
.exe,.scr,.bat,.js,.msi; .apkfiles on phones — a very common scenario on Telegram: "Photos from the event", "Your parcel" or "Payout list" turns out to be an app that reads your SMS and confirmation codes;- password-protected archives with the password in the message — a way to bypass antivirus scanning;
- Office documents asking you to "enable content" or macros;
- double extensions:
Invoice.pdf.exe.
Never install apps from messages. Use official app stores only.
SMS and messenger scams common in the region
- "Bank security team" calls or messages about a suspicious transaction and asks for the SMS code. A real bank never asks for codes.
- A buyer on a classifieds site sends a link "to receive payment". The page asks for card details and a code, and money leaves your card instead.
- Prizes, payouts and compensation in the name of government bodies or well-known brands, where you must "pay a fee" or enter card details.
- Parcel on hold — a link to a fake delivery service asking for a "customs fee".
- A message from a friend asking to borrow money or vote in a contest — the friend's account has already been hijacked.
- A high-paying job requiring no experience, where at some point you must send money or hand over data.
What to do if you already clicked
- You entered nothing — close the page and delete the message.
- You entered a password — change it right away on the real site and anywhere else you reused it, turn on two-factor authentication and end unknown sessions.
- You entered card details or a code — call your bank immediately on the number on the back of the card and block it.
- You installed a file — disconnect the device from the network, remove the app, scan the device and change passwords from another, clean device.
- It is a work account — tell whoever is responsible for IT. Reporting fast matters more than embarrassment.