How to Spot Phishing and Impersonation Attempts
In short
Phishing and impersonation try to make you act before you think — usually by pretending to be a bank, company or person you trust. The warning signs are consistent: a sender address that's slightly off, urgent or threatening language, unexpected links or attachments, and requests for passwords, codes or payments. When in doubt, don't click — contact the organisation directly using details you already have, not the ones in the message.
How phishing works
Phishing is a message — email, SMS, chat or call — designed to trick you into revealing information (passwords, codes, card details) or making a payment, by impersonating a trusted source. Impersonation goes further, posing as a specific company or person you know.
The tell-tale signs
Most phishing shares the same fingerprints:
- A sender address or number that's subtly wrong or generic.
- Urgency or fear: 'act now', 'account suspended', 'unauthorised login'.
- Unexpected links or attachments — hover to check where a link really goes.
- Requests for passwords, one-time codes, or a payment you weren't expecting.
- Slight errors in logos, wording or formatting; or a greeting that's oddly generic.
What to do instead
If a message asks you to act, slow down. Don't click links or share codes. Contact the company or person directly using details you already have — the number on your card, the official website you type yourself — not the contact details in the message. Report suspected phishing to the impersonated organisation.
For businesses, a simple 'verify through a second channel' rule prevents most impersonation and payment-diversion attempts.
Frequently asked questions
What is the clearest sign of a phishing message?
Pressure to act urgently combined with an unexpected request for passwords, one-time codes, or a payment — often from a sender address that's subtly wrong. When in doubt, verify through a channel you already trust.
Someone is impersonating a company I use — what should I do?
Don't respond via the message. Contact the real organisation using details you already have, and report the impersonation to them so they can warn others.
This article is general, educational information about online safety and is not legal or financial advice.