RECOGNIZE THE RED FLAGS
OF PHISHING ATTACKS

Do not assume messages or links are safe. Understand the common signs of phishing and
take steps to protect your identity and accounts.

WAYS TO IDENTIFY PHISHING

Recognizing phishing attempts is one of the most powerful ways to protect yourself online. Cybercriminals rely on human error, not technical flaws. It is to steal personal and financial information. By understanding the signs of a phishing attack, you can avoid being tricked into clicking malicious links, sharing confidential data, or downloading dangerous attachments.

Learning to identify phishing attempts helps you stay one step ahead of cybercriminals and ensures your data and identity remain secure.

Spear Phishing

Be cautious of personalized emails asking for confidential info or urgent action. Always confirm the sender’s identity through another trusted channel before responding.

Example: An email from “HR” asks you to sign a new onboarding form hosted on a link that isn’t the company domain.

Vishing

Do not trust unsolicited phone calls asking for personal or financial info. Verify the caller’s identity through official numbers before sharing anything.

Example: A caller claiming to be “IT support” pressures you to read out a one-time code to “fix your account.”

Email Phishing

Check email addresses carefully and avoid clicking on suspicious links. Look for grammar mistakes, urgent requests, and inconsistencies.

Example:An invoice-looking email from “billing@service-pay.com ” asks you to click a link to view an overdue payment.

HTTPS Phishing

Look for mismatched URLs and SSL certificates. Even if the site says “HTTPS,” ensure the domain matches the official website.

Example: A message links to https://secure-pay-login.example-login.com asking you to re-enter your bank password.

Pharming

Keep antivirus updated and watch for unusual redirects. Type website addresses manually instead of clicking links.

Example: Typing mybank.com redirects you to a login page that looks real but sends credentials to a fake server.

Pop-up Phishing

Never click on unexpected pop-ups claiming security issues. Close the pop-up and access the website directly.

Example:A browser popup warns “Your device is infected, download this tool now” with a download button.

Evil Twin Phishing

Avoid public Wi-Fi or verify networks before connecting. Use VPNs for safety.

Example: A public hotspot named “Cafe_Guest_WiFi” prompts you to enter your email and password to “connect.”

Watering Hole Phishing

Keep software updated and avoid visiting suspicious websites. Monitor sites frequently used by your organization.

Example:A frequently used industry blog suddenly shows a “download report” button that delivers malware when clicked.

Whaling

High-level executives should scrutinize unusual emails, links, or requests. Confirm any financial or sensitive requests directly.

Example: An email to the CEO from “the CFO” requests an urgent wire transfer to a new account for a confidential deal.

Clone Phishing

BCheck if the email is identical to a previous one and verify links before clicking.

Example:You get a “resend” of last week’s delivery confirmation but the new download link goes to a malicious file.

Deceptive Phishing

Always verify the sender through official channels. Avoid clicking on urgent “account blocked” messages.

Example:An email branded with a bank logo warns your account is locked and asks you to “verify” by clicking a link.

Social Engineering

Be cautious of psychological pressure to share personal info. Confirm requests through trusted sources.

Example:Someone posing as a coworker asks you on chat to share the password for a shared folder “so I can finish a report.”

Angler Phishing

Check social media accounts for legitimacy. Avoid providing info in responses to suspicious posts.

Example:A reply from a fake “@brand_support” Twitter account asks you to DM your order number to process a refund and then sends a link.

Smishing

Do not click on links in unsolicited SMS messages. Confirm requests via official communication.

Example:A text message claims your parcel delivery failed and includes a link to “reschedule” that asks for login details.

Man-in-the-Middle (MiTM) Attacks

Use HTTPS websites, secure networks, and VPNs. Avoid public Wi-Fi without protection.

Example: On a coffee shop Wi‑Fi, a login page appears for your email that intercepts your credentials while you sign in.

Stay safe from these scams! Discover our top prevention tips.

Read tips