Phishing: how to recognise fake emails and messages
Fake emails, text messages and calls are the most common way into a computer or an account. Six signs that help you recognise them, and what to do if you clicked.
Photo: Sasun Bughdaryan / Unsplash
A parcel that could not be delivered, an account that will be closed, an invoice you do not know: phishing messages try to make you click a link, open an attachment or give away a password. They are getting better, but these signs still give them away.
Six signs of a phishing message
- Pressure and urgency: "Your account will be blocked today" is meant to stop you from thinking.
- An unexpected request: You are asked to log in, pay or confirm details you did not expect to.
- The sender address: The name looks right, but the address behind it does not belong to the company.
- The link target: On a computer, point at the link without clicking: the address shown does not match the company.
- Attachments: Unexpected invoices, ZIP files or documents that ask you to "enable content".
- A general greeting: "Dear customer" instead of your name, often with spelling mistakes.
Phishing does not only come by email
Text messages (smishing), WhatsApp messages and phone calls (vishing) work the same way. A typical call claims to be from "Microsoft support" and asks you to install a program. Real companies do not call you out of the blue about a problem on your computer.
How to check a message
- Do not use the link or phone number in the message.
- Open the website or app yourself, or call the number you already know.
- Ask a colleague or someone you trust if you are unsure.
What to do if you clicked
- Change the password of the affected account right away, and of every account that uses the same password.
- Switch on two-factor authentication where possible.
- Call your bank if you entered card or banking details.
- Disconnect the computer from the internet if you opened an attachment, and get help.
Report the message to the National Cyber Security Centre (NCSC) at report.ncsc.admin.ch to help warn others.
Protection that helps
Two-factor authentication, a password manager, current updates and a backup make phishing much less dangerous. An IT Security Check shows where your business stands; private people get patient help with Help at Home & Training.
