Spotting Phishing and Scam Sign-Ups

Most account takeovers start with a convincing message and a hurried click. A few habits stop nearly all of them.

The shape of a phishing attempt

A phishing message imitates something you trust and pushes you to act fast: a login that "expired", a prize that "ends today", a payment that "failed". The urgency is the tell, because it exists to stop you checking.

Checks that take seconds

• Look at the real sender address and the real link target, not the display text.
• Go to the site yourself, by typing the address, rather than following the link.
• Be wary of any page that asks for a password or payment details out of the blue.
• Treat an offer that seems too generous as a reason to slow down, not speed up.

Make the damage small in advance

Use a unique password per account so one leak does not open the others, turn on two-factor authentication where you can, and keep a separate email alias for sign-ups you are unsure about.

If you slip

Change the password at once, from a device you trust, and sign out other sessions. Then check whether the same password guards anything else, and change those too.

Urgency and reward are the two levers

Almost every scam pulls one of two levers: fear that something will be lost if you do not act now, or the promise of something gained if you do. Both are designed to stop you checking. Treating any message that rushes you, or that offers more than seems reasonable, as a cue to slow down defuses most attempts before they start.

Verify through a channel you already trust

When a message claims to be from your bank, a shop or a service, do not use the contact details it provides. Open the app you already have, or type the address you already know, and check from there. A real problem will still be waiting for you; a fake one disappears the moment you stop using the link it gave you.

Check the sender, not the logo

A convincing logo and a familiar layout are trivial to copy; the real sender address and the true link destination are much harder to fake and much more telling. Hover over or long-press a link to see where it actually goes before tapping, and be suspicious of an address that is close to a real one but not quite right.

No real service makes you prove loyalty by entering your password into a link from a message. When in doubt, navigate there yourself.

Updated 2026-11-10