What phishing is after
Phishing messages want one of three things: to get you to type your username, password or card details into a fake site, to get you to install a malicious app or file, or to get you to send money directly. The wording keeps changing, but the structure is nearly always the same: push the recipient to act before they have time to think. Learning to recognise that structure lasts longer than memorising particular phrases. Remember too that texts are harder to check than emails, because the screen is small and addresses are cut off.
Common pretexts
Phishing texts hide behind ordinary events that almost anyone might be expecting. When the message matches something you are waiting for, your guard drops.
- A parcel with a wrong address or on hold
- A traffic fine or penalty to look up
- A health check-up, tax refund or benefit notice
- A digital wedding invitation or funeral notice
- A relative or friend saying their phone broke and texting from a new number
Signals in the wording
Public agencies and financial firms rarely text a short link asking you to enter personal details. Pressure such as 'today only', 'immediately' or 'account suspended', and greetings like 'Dear customer' with no name, are common signals. Awkward spelling sometimes gives a message away, but many scams now read naturally, so that alone is not a test. The decisive signal is not the content but the request. If the message wants you to tap a link, install an app, reply or send money, stop there.
How to read an address
Before tapping, long-press the link to preview it or copy it to check. The part before the first slash is where you will connect, and its last two or three segments show who really owns it. An agency's name near the front means nothing if the ending is different. Look-alike characters are a common trick, such as a lower-case r and n placed together to resemble m, or the digit 0 standing in for the letter o. Shortened links hide the destination, so as a rule do not tap them in any message about money or personal data.
Extra checks for email
Anyone can type any sender name into an email. Look at the actual address next to the name, not the display name. Attachments deserve care as well.
- Does the display name match the real email address?
- Is a 'company' email coming from a free personal account?
- Is there an executable, an archive, or a document asking you to enable macros?
- Is the reply-to address different from the sender?
- Are you asked to pay into an account different from the usual one?
Handling family impersonation
A message beginning 'Mum, my phone broke, I'm on a temporary number' is a textbook impersonation scam. It usually goes on to ask for gift cards, a photo of your ID, or for you to install a remote-control app. Before replying, call the number you already know for that person. Agreeing on a check question or code word within the family in advance also helps. Whatever the story, never hand over an ID photo or install remote-control software on the strength of a message alone.
The right way to verify
If in doubt, do not use any link or phone number in the message. For a parcel, check the delivery app or order history you already use; for a fine, go to the agency's official website; for your bank, find the number on the back of your card or in the official app. Calling the number in the message may simply connect you to the scammers. Verification takes a few minutes, and if the matter is genuine nothing is lost. Do not reply to a suspicious message, and if you plan to report it, take a screenshot before deleting it.
If you already clicked or typed
If you only opened a link and entered nothing, serious harm is unlikely, but installing an app it asked for is a different situation. The faster you act, the smaller the damage. Procedures and numbers can change, so check the relevant agency's official guidance as well.
- If you installed an unknown app, switch on airplane mode and delete it
- If you entered a password, change it on that account and every account that shares it
- If you gave financial details or sent money, call the bank's official number at once and ask to stop payment
- In Korea, contact the police on 112, KISA on 118 or the Financial Supervisory Service on 1332
🌍 Search the web for this
Each button runs this keyword on that search engine