“7 Red Flags That Reveal a Phishing Message”

You get a text: “Your package could not be delivered. Click this link to pay the fee.” You get an email: “Your bank account will be locked. Verify now.” One of these might be real. The other is a trap.

Learning how to spot phishing messages is one of the most useful skills you can pick up online. It takes just a few minutes to learn, and it can protect your money, your accounts, and your peace of mind. This guide explains everything in simple language, with real examples you have probably already seen.

The Bait Behind the Message

A phishing message is a fake message that pretends to come from a company or person you trust. Its goal is simple: to steal your personal information, such as your password, bank details, or one-time code (OTP). The word “phishing” comes from “fishing” — the scammer throws out bait and waits for someone to bite.

Phishing comes in a few flavors:

• Phishing — fake messages sent by email.
• Smishing — phishing by SMS text message. Example: a text saying your package delivery failed.
• Vishing — phishing by phone call. Example: someone calls and claims to be from your bank’s fraud department.

Here are three classic examples you may have seen in your own inbox:

• A text saying “Your package could not be delivered” with a link to reschedule.
• A text or email saying “Your bank account is locked” and asking you to log in.
• A message saying “You have won a prize!” and asking you to claim it with your card details.

Scammers send millions of these because they are cheap to send, and it only takes a few people clicking to make the scam profitable. The good news: the messages almost always share the same warning signs.

Spotting a Phishing Message: 7 Red Flags

Here are the seven red flags that give phishing messages away. If you see even one or two of them, slow down and be careful.

Urgent or threatening language

Phrases like “Act now!”, “Your account will be suspended”, or “Immediate action required” are designed to make you panic. Panic stops you from thinking clearly. Real companies rarely pressure you this way. If a message tries to rush you, that is a red flag.

A sender you don’t recognize

Check who the message is really from. An email claiming to be from your bank but sent from an address like support-bank123@randommail.com is fake. For texts, watch out for messages from unknown numbers, especially long or international-looking ones. Scammers can fake names and logos, but they cannot use the company’s real official address.

Odd or shortened links

Phishing messages almost always include a link. Watch out for links that look odd, are very long and messy, or use a link shortener to hide the real address. On many phones you can press and hold a link to preview where it really goes — without opening it. If the preview does not match the company’s real website, do not tap it.

Sloppy spelling and grammar

Many fake messages have spelling mistakes, odd grammar, or awkward phrasing like “Dear customer your account has been suspend.” Big companies have teams that check their messages before sending. Sloppy writing is a classic sign of a scam.

Requests for passwords, OTPs, or payment details

A message that asks you to type in your password, share a one-time code, or enter your card number is almost certainly fake. Legitimate companies do not collect sensitive information through random links in messages. This is such an important point that it gets its own section below.

Prizes too good to be true

“You won a free phone!” “Claim your $500 gift card!” If you never entered a contest, you did not win anything. Fake prize messages are designed to make you excited — and excitement, like panic, makes you click without thinking.

‘Dear Customer’ and other generic greetings

Real companies usually address you by name. Phishing messages often start with vague greetings like “Dear customer”, “Dear user”, or just “Hello”. Why? Because the scammer is sending the same message to thousands of people and does not know your name.

In a Hurry? The 10-Second Check

When you are busy, you will not have time to check all seven red flags. Memorize this three-second test instead:

• Who sent it — do I know and trust the real sender?
• Why the rush — is it pushing me to act fast?
• What it wants — is it asking for codes, passwords, or money?

If any answer feels off, treat the message as fake until you can verify it another way. A real bank or delivery company will never mind you double-checking.

The Golden Rule Banks Want You to Know

Here is the one rule every bank and consumer-protection agency repeats: no legitimate bank or government agency will ever ask for your OTP, password, or PIN over email, text, or phone call. Not to “verify your identity.” Not for any reason.

The American Bankers Association even runs a campaign built around this idea — banks never ask that. A real bank will never threaten to close your account if you do not reply, and it will never ask you to click a link and log in through a message it sent you. So the moment a message or caller asks for a code, a password, or your full card number, you have your answer: it is a scam. Hang up or delete the message.

Got a Suspicious Message? Do This

Getting a suspicious message is not an emergency. Stay calm and follow these steps:

• Do not click any links. Not even to “see what it is.”
• Do not download attachments or reply to the message.
• Verify on your own. Open the company’s official app, or type its official website address into your browser yourself — never use the link in the message. You can also call the number printed on your bank card or statement.
• Delete the message once you have confirmed it is fake.
• Block the sender so they cannot message you again.
• Report it. Most phones let you report a text as spam, and many email apps have a “report phishing” button. Reporting helps protect other people too.

Oops — You Already Clicked. Now What?

It happens to everyone. If you clicked a suspicious link or typed in some information, do not panic — act quickly instead:

• Change your passwords right away, starting with the account you think may be affected.
• Turn on two-factor authentication (2FA) on your important accounts. This adds a second check at login, so a stolen password alone is not enough to get in.
• Watch your bank statements for any strange or unknown charges, and tell your bank if you see something odd.
• If you shared payment details, call your bank using the number on your card and ask them to help secure your account.

Phishing Questions, Answered

Can phishing messages come from a real-looking phone number?

Yes. Scammers can fake caller ID and sender names so a text looks like it came from your bank. This is called spoofing. Never trust the name or number shown on the screen alone — always verify through the company’s official app or website.

What if I clicked a link but did not enter any information?

You are probably fine, but stay cautious. Just visiting a page does not usually do harm, but the site could try to download something or trick you on a second screen. Close the page, run a quick check for anything strange on your device, and do not enter any details if the site asks.

Are short links always scams?

No — many legitimate companies use shortened links too. The problem is that a short link hides the real destination. If you did not expect the message, press and hold the link to preview it first. When in doubt, go to the company’s official website by typing the address yourself instead.

Should I reply “STOP” to a suspicious text?

No. Replying tells the scammer your number is active, which can lead to more spam. Just delete the message, block the number, and report it as spam on your phone.

Can a phishing message install a virus on my phone?

A message by itself usually cannot harm your phone. The danger comes from clicking links or opening attachments, which can lead to fake login pages or harmful downloads. If you avoid clicking and downloading, you avoid almost all of the risk.

Phishing works because it plays on everyday emotions — worry about your money, excitement about a prize, fear of losing an account. Now you know the pattern. Slow down, check the red flags, and verify through official channels. That simple habit is all it takes to leave the scammers fishing with an empty hook.