Recognizing Phishing Messages Before Sharing Passwords or Payment Details
Check suspicious messages through independent trusted channels before sharing passwords, authentication codes, files or payments, and respond to actual exposure.
On this page
- Identify what the message wants you to do
- Notice pressure without relying on poor spelling
- Use contact information from outside the message
- Treat links, attachments and QR codes as destinations to verify
- Protect passwords and authentication prompts
- Use a scenario to practise the decision
- If you already interacted, respond to what happened
- Related guides
- Common questions
- Sources and references
A convincing message can arrive at exactly the moment you expect a delivery, invoice or account alert. Recognising phishing therefore requires more than checking whether the logo looks familiar. The useful habit is to pause before sharing information or following a payment instruction, then verify the request through a route you already trust. This guide draws on US, UK and Australian public cybersecurity guidance. It describes practical checks for ordinary users, not a guarantee that every malicious message can be recognised by appearance.
Identify what the message wants you to do
Read the requested action before focusing on the story. Is the sender asking you to enter a password, provide a verification code, download a file, scan a QR code or pay a new account? The action is the part that can put information or money at risk.
A message may claim that an account will close, a parcel cannot be delivered or a payment needs correction. The FTC describes phishing as an attempt to obtain sensitive information through messages that impersonate trusted organisations. Familiar subject matter does not establish that the sender is genuine.
Separate the claim from the response it demands. You can investigate whether there is a real delivery problem without using the message’s link. You can check an account alert through the official app without entering credentials into the page supplied by the alert.
Notice pressure without relying on poor spelling
The UK National Cyber Security Centre explains that scams can look convincing and that familiar clues such as bad grammar are not dependable filters. Urgency, authority, emotion and scarcity can be used to rush a decision. Treat them as reasons to pause, rather than as proof that every urgent message is fraudulent.
A polished invoice or a message containing your real name can still be deceptive. Conversely, a genuine message can contain a typo. Use appearance as supporting context, not the final test of whether to send information or make a payment.
When a request creates pressure, write down the actual question you need answered: whether an invoice exists, whether an account needs attention or whether payment details changed. That converts a vague alarming story into something you can verify independently.
| Message asks for | Pause before | Safer verification route |
|---|---|---|
| Account sign-in | Entering a password through its link | Open the known official app or saved site |
| Changed payment details | Sending money to the new destination | Contact the intended recipient using known details |
| Authentication code | Sharing it with the caller or sender | Check the service through its official support route |
| Unexpected attachment | Opening or enabling its contents | Verify the file with the apparent sender separately |
| QR-code action | Treating the code as proof of authenticity | Reach the service independently |
Use contact information from outside the message
FTC guidance recommends contacting an organisation through a website or phone number you know is trustworthy. Do not use the suspicious message’s own number as the only way to check whether it is genuine. The same applies to a reply address supplied in the message.
For an account you already use, open the official app or your established bookmark and check for the relevant notice. For a known person, use a contact method you already had before the unexpected request. If the request involves a workplace account, follow the organisation’s reporting process.
Be careful when searching for contact details: an advertisement or a lookalike result can introduce another uncertainty. Prefer an established official site or information already held in legitimate account documents. Do not improvise a new sign-in route just because the message urges speed.
- Read the requested action.
- Stop before sharing, downloading or paying.
- Open an independent trusted contact route.
- Confirm the underlying request.
- Act only through the verified service if appropriate.
Treat links, attachments and QR codes as destinations to verify
A displayed name or logo can be copied. A link can lead somewhere different from what its surrounding text suggests. If the destination is uncertain, there is no need to open it to prove that the message is suspicious; use an independent route instead.
Australian cybersecurity guidance identifies phishing through QR codes as well as ordinary links. A code is a way of encoding a destination, not evidence that the destination belongs to the organisation shown beside it. An unexpected code in an email deserves the same pause as an unexpected sign-in link.
Do not open an attachment merely because the sender’s display name is familiar. If you expected a document but the delivery method or file is unusual, check with the sender separately. Avoid enabling software features or installing an app simply because a document says that is required to view it.
Protect passwords and authentication prompts
Australian guidance advises against giving out passwords or authentication codes and recommends strong account security, including passkeys or multi-factor authentication where available. These controls help protect an account, but they should be combined with careful handling of unexpected requests.
If a caller asks you to read out a code, pause and verify the situation through the service’s official channel. A code arriving on your phone does not prove that the caller is legitimate. The code may relate to an action you did not intend to authorise.
Similarly, do not approve an unexpected authentication prompt just to make it disappear. Check your account through a trusted route and follow the service’s guidance. At work, report the event to the appropriate security team without forwarding passwords or secret recovery information.
Use a scenario to practise the decision
Imagine a fictional message saying an invoice for 240 currency units must be paid immediately to a new account. It uses the name of a supplier you recognise and says that calling will delay delivery. The amount and deadline are invented; they are not a report about a real business.
The useful response is to separate the invoice question from the new-bank-details question. Check your own purchase record, then contact the supplier using details already on file. If a genuine invoice exists, that still does not authenticate the changed payment destination.
Now imagine the sender asks for a six-digit code to confirm your identity. The length of the code does not make the request safe. Treat the request for an authentication secret as a separate issue and use the official service to investigate.
- Does the 240-unit invoice match a real purchase?
- Were the new payment details independently confirmed?
- A familiar supplier name does not answer either question by itself.
- Never send an authentication secret to settle the uncertainty.
If you already interacted, respond to what happened
Distinguish opening a message from entering credentials, downloading software or sending money. Record what you actually did and when. This helps the relevant provider or support team give instructions matched to the incident instead of responding to an unclear account.
If account details may be compromised, use the service’s official recovery or security process from a trusted device or route. If banking or payment details are at risk, contact the bank or payment provider promptly through verified channels. Do not keep negotiating with the suspicious sender for reassurance.
Use official local reporting channels and workplace procedures where applicable. Keep useful evidence, but avoid circulating private credentials or other people’s sensitive information. The reporting routes in the linked US, UK and Australian sources have their own geographic scope.
Our privacy policy explains this publication’s data handling. Use the contact page for an editorial correction, not to send passwords or recovery codes. The editorial policy describes source checks; this guide is general education and does not replace incident-specific support.
Related guides
Continue with Choosing a Password Manager: Security Features, Recovery and Subscription Costs and Family Online Safety Tools: Controls, Limitations and Subscription Options. Each guide identifies its scope and any country-specific rules.
Common questions
Can a perfectly written message still be phishing?
Yes. Public cybersecurity guidance notes that scam messages can be convincing. Verify the requested action independently rather than relying on spelling, branding or a professional-looking layout.
Does a familiar sender name prove the message is genuine?
No. Display names and branding can be copied. Use an established contact route to confirm an unusual request, especially one involving credentials, downloads or changed payment details.
Should I call the number in the suspicious message?
Use contact details obtained independently from a trusted source instead. A number supplied by the suspicious message can lead back to the same person making the request.
Are QR codes automatically safer than links?
No. A QR code can direct you to a website just as a link can. An unexpected code does not authenticate the organisation or the destination it represents.
Should I share a verification code with an unexpected caller?
No. Do not give out authentication codes in response to an unexpected request. Check the situation through the service’s official route and protect the account’s recovery information.
Does multi-factor authentication remove all phishing risk?
No security measure makes every request trustworthy. Use available account protections alongside independent verification, and do not approve unexpected prompts or share authentication secrets.
What if the invoice itself is real?
A genuine purchase does not confirm a newly supplied payment destination. Verify changed bank details independently with the intended supplier before relying on the message’s instructions.
What should I do after entering a password?
Use the official service’s security or recovery process and seek appropriate support. Describe what happened accurately, and avoid returning to the suspicious link for further instructions.
What if I already sent money?
Contact the bank or payment provider promptly through verified channels and explain the transaction. Follow its incident guidance and the applicable local reporting process; recovery is not guaranteed.
Can I send this site my code for checking?
No. Do not send passwords, authentication codes or recovery secrets through a publication’s contact form. Use the relevant account provider’s official support and security process.
