Phishing is one of the most common ways that passwords are stolen. It skips all the maths, because you hand over the password yourself. This guide is part of our section on data breaches and hacked accounts.
How it works
- You get an email, text or social media message that looks real.
- It creates urgency: your account is locked, a parcel is held, a payment failed.
- A link takes you to a copy of the real login page.
- You type your password, and it goes straight to the attacker.
- They may use it in real time, and even ask for your two-factor code.
Warning signs in the message
- Urgency or threats.
- A greeting that does not use your name, or a sender address that looks slightly wrong.
- Requests for passwords, codes or payment.
- Links that do not match the company's real address.
- Unexpected attachments.
Be aware that modern phishing can be polished, with perfect spelling. Bad grammar is no longer a reliable sign.
Warning signs on the page
Check the domain carefully. The important part is what comes right before the first single slash:
| Address | Real or fake? |
|---|---|
accounts.google.com/signin | Real domain: google.com |
google.com.account-verify.net/login | Fake domain: account-verify.net |
paypa1.com | Fake, with a number 1 for the letter l |
These are illustrations only, so do not visit them.
Habits that protect you
- Go direct. Do not click login links in messages. Open the app or type the address.
- Use bookmarks for banks and important accounts.
- Let your password manager fill. If it will not, stop and check. See how managers work.
- Be careful with search ads. Fake sites can appear above real ones.
Technology that blocks phishing
Security keys and passkeys refuse to work on a fake site, even if you are completely fooled. Authenticator codes help, but a real-time attacker can capture and use them. See 2FA methods compared.
What to do if you fell for it
- Change the password on the real site, right away.
- Change it anywhere you reused it.
- Log out of other sessions, and check your recovery settings.
- If you shared a code or card number, call your bank.
- Report the message, using the button in your email app.
Follow the steps for hacked accounts if you have lost access. Crypto holders should read about phishing and wallet drainers, since those losses are usually final.