What is phishing?

Phishing is a scam in which someone pretends to be a real company or organization to get you to hand over your sign-in details, card number, or other personal information. A message that seems to come from your bank, a card company, a delivery service, an online store, or a government agency leads you to a fake site that looks just like the real one.

For a small business, one compromised account, whether it’s email, accounting, payments, bookings, or the platform that hosts your online course, can affect your money, your customers’ information, and your conversations with students. Knowing the usual patterns and what to check lets you handle a suspicious message calmly.

How does a phishing attack unfold?

Most phishing follows the same steps:

1. A message arrives that claims to be from a real organization. It usually pushes you to act fast, with lines like “We detected an unusual sign-in” or “We couldn’t process your payment.”
2. A link or QR code takes you to a fake site that copies the real one.
3. A sign-in or “verify your identity” page asks you to enter your details.
4. The attacker uses what you entered to sign in to the real site, take over your account, or move money.

Phishing pages ask for things like passwords, card and bank account numbers, one-time codes, and personal details such as your address and date of birth. Some messages instead try to get you to install a fake app or open an attachment that infects your device with malware (malicious software).

What forms does phishing take?

Form	A typical example
Email	Claims to be from your bank or an online store and says your account is on hold until you confirm your details
Text message	Claims to be from a delivery company and says a package couldn’t be delivered, with a tracking link. Phishing by text is sometimes called smishing
Fake sign-in page	Reached from a search ad or a social media message, and looks exactly like a real sign-in page
QR code	A code in an email, or a fake sticker placed over a real code on a parking meter or poster, opens a fake payment or sign-in page
Fake support	A fake virus warning fills your browser and tells you to call a number, where “support” talks you into giving remote access or paying

Whatever the form, these messages share one trait: they try to stop you from thinking it over, with words like “urgent,” “today,” or “your account will be closed.” Clumsy grammar used to be a giveaway. But as the US Cybersecurity and Infrastructure Security Agency (CISA) points out, AI tools now let scammers write polished messages, so good writing proves nothing.

How do scammers make fakes look real?

Copying logos and senders

Logos, colors, and wording are easy to copy from real emails and pages. The sender name and address shown in an email are easy to fake, too, because of the way email works. On a phone, mail apps often show even less about the sender, which makes a fake harder to spot.

Lookalike domains

A domain is a site’s address on the web, like example-school.com. Fake sites use domains that look close to the real one.

Trick	Example (the real one is example-school.com)
Swap in similar letters	exarnple-school.com (r and n instead of m)
Add a word	example-school-login.com
Change the ending	example-school.net
Put the real name in front	example-school.com.account-check.net

The last one is the most misleading. Read a domain from the right. In this example, the part that tells you who owns the site is account-check.net, at the right end. The owner can put anything they like to the left of it, so seeing the real name there means nothing.

HTTPS doesn’t mean genuine

An address that starts with https:// means the connection is encrypted. It doesn’t tell you who you are talking to. A fake site can use HTTPS on a domain it registered itself.

Why can passwords and codes be stolen too?

A fake site simply receives whatever you type. That includes one-time codes from a text message or an authenticator app, not just passwords. A code stops working quickly, but some fake sites pass your password and code to the real site the moment you enter them, and sign in as you. A code you type in has no way of knowing which site it was typed into. Two-factor authentication still stops someone who only has a stolen password, but it can’t reliably protect you once you’ve typed both into a fake site. For more, see “What is two-factor authentication (2FA)?”

Passkeys hold up much better. A passkey is tied to the domain of the site where you created it, so it is never used on a fake domain. It protects you even when you can’t tell the fake from the real thing. “What is a passkey?” explains how. One caveat: if your account still has other ways to sign in, such as a password, a fake site will try to get you to enter those instead.

What should you check before you sign in?

1. Don’t sign in from links or QR codes in messages you weren’t expecting. Use a bookmark or the official app. If you search for the site, watch out for ads at the top of the results, which sometimes lead to fake sites. The US Federal Trade Commission (FTC) notes that legitimate companies won’t email or text you a link to update your payment information.
2. Check the domain in the address bar before you enter anything. When you scan a QR code, check the domain your phone shows before you open it.
3. Keep your passwords in a password manager or your browser’s built-in one. It only fills in a password on the domain where you saved it, so if it doesn’t fill in where it normally would, treat that as a warning sign. The UK’s National Cyber Security Centre (NCSC) says password managers are better than people at spotting fake websites.
4. If a message rushes you, pause. If you’re unsure, contact the organization through a website or phone number you look up yourself, not the details in the message.
5. Ignore sign-in codes and approval prompts you didn’t ask for, and never share a code with anyone.
6. Set up passkeys or two-factor authentication, and don’t reuse passwords. Turn on spam filtering for your email and text messages, too.

What should you do if you already entered your details?

First, write down what you entered. Then work through what applies.

What you entered or did	What to do
Username and password	Change the password right away on the real site, opened from a bookmark or the official app. Change it on any other service where you used the same password. Check your sign-in history for anything you don’t recognize
One-time code	Change your password and check your sign-in history the same way. If the service lists signed-in devices, sign out any you don’t recognize
Card number	Contact your card issuer’s lost or stolen card line and have the card blocked
Online banking details	Contact your bank right away
Installed an app or opened a file	Remove the app and scan your device with security software

If it’s a work account, tell whoever manages your organization’s accounts as well. The sooner they know, the easier it is to protect everyone else.

Where to report phishing

Where you are	Where to report
United States	Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and scam texts to 7726 (SPAM). Report scams to the FTC at ReportFraud.ftc.gov. If you gave out personal information, IdentityTheft.gov lists next steps
United Kingdom	Forward phishing emails to report@phishing.gov.uk and scam texts to 7726. If you lost money or were hacked, report it to Report Fraud (England, Wales, and Northern Ireland) or Police Scotland. See the NCSC’s reporting guide
Japan	Report phishing emails, texts, and sites to the Council of Anti-Phishing Japan. Report damage, such as lost money, to the police
Elsewhere	Look for a reporting channel from your national cybersecurity agency or the police

Many email apps also have a “Report phishing” or “Report spam” button. Reporting helps stop the same scam from reaching other people, so it’s worth doing before you delete the message.