Sentrly
Phishing Attacks: How to Spot and Avoid Them
The single most common way ordinary people lose money online — and how to recognise it.
Phishing is when an attacker sends a message pretending to be a trusted brand, hoping you click a link or reveal a password. Slow down, check the sender’s real domain, never click urgent links inside emails, and verify by visiting the company’s site directly.
Key takeaways
- Phishing usually creates urgency — ‘Your account will be locked in 24 hours’.
- Sender names lie; the actual email domain often gives the scam away.
- Hover over links before clicking — the URL preview is the truth.
- Banks and tax authorities never ask for passwords by email.
The classic email scam
You receive a message from a brand you use — bank, courier, streaming service. It claims something is wrong and asks you to ‘verify’ your account by clicking a link. The link goes to a page that looks identical to the real one. You type your password. The attacker now has it.
How to spot the fakes
Check the sender domain (not the display name). Hover over the link to see where it really goes. Look for slight misspellings — ‘paypa1.com’ instead of ‘paypal.com’. Notice generic greetings like ‘Dear Customer’ from companies that know your name.
Modern variants
Smishing is phishing by SMS. Vishing is phishing by phone call, often using AI-cloned voices. Quishing uses QR codes that lead to fake login pages. The defence is the same: verify through a channel you initiated.
If you clicked
Don’t panic. Change the password from a different device. Enable two-factor authentication. Check account activity. Notify the real company. Watch your bank for unusual charges.
Frequently asked questions
Are spam filters enough?
They catch most phishing, but determined attackers craft messages to slip through. Personal awareness still matters.
Can a VPN protect me from phishing?
No. A VPN encrypts traffic; it does not detect fake login pages. Use a password manager and 2FA instead.
Should I report phishing emails?
Yes. Most email providers have a one-click report button, and your tax authority typically has a phishing inbox.
Related guides
Two-Factor Authentication: A Complete Beginner’s Guide
The single most effective security upgrade most people can make in five minutes.
Read article →Password Manager Best Practices in 2026
Choose, set up, and live with a password manager without locking yourself out.
Read article →Ransomware Protection for Home Users: A Practical Guide
Backups, updates, and a few simple habits that prevent the worst day of your digital life.
Read article →