Phishing remains one of the most common ways accounts get taken over, because it targets people rather than software. A phishing message pretends to come from a bank, a delivery company, your employer or a well-known online service, and it tries to push you into clicking a link, opening a file or typing a password. The messages are now often well written and carefully designed, so the old advice to look for spelling mistakes is no longer enough. The habits below work even when an email looks convincing. 1. Check who is really sending it The name shown at the top of an email is easy to fake. What matters is the actual address, especially the part after the @ sign. Look closely for lookalike domains, such as a letter swapped for a similar one, an extra word added to a brand name, or an unusual ending. A message from "support" at a strange domain is not from the company it claims to represent, no matter how good the logo looks. 2. Be wary of urgency and threats Scammers want you to act before you think. Phrases such as "your account will be closed in 24 hours" or "confirm your payment now" are designed to create pressure. Real organizations usually give you a clear process and enough time, and they rarely ask you to solve a problem by replying with sensitive details. 3. Look at the link before you click On a computer, hover over a link to see the real destination in the corner of the browser. On a phone, press and hold the link to preview it. If the address does not match the company named in the message, or if it is a shortened link you cannot read, do not open it. The safest habit is to ignore the link completely and open the official website or app yourself by typing the address or using a bookmark. 4. Treat unexpected attachments with caution Fake invoices, delivery notices and "documents to review" are a common way to spread malware. Be especially careful with compressed files, and with Office documents that ask you to enable macros or editing before you can see the content. If you did not expect the file, confirm with the sender through a different channel before opening it. 5. Never share passwords or one-time codes No genuine support team needs your password. One-time codes sent by SMS or an authenticator app are meant only for you. If someone asks you to read a code aloud or reply with it, assume it is an attempt to break into your account. 6. Verify through another channel If a message claims to be from your bank, a supplier or a colleague, contact them using a phone number or address you already know, such as the one printed on your card or listed on the official website. Do not use contact details provided in the suspicious message itself. What to do if you already clicked Do not panic, but act quickly. If you only opened the link and entered nothing, close the page and run a security scan on your device. If you typed a password, change it immediately on the real website, and change it anywhere else you used the same password. Turn on two-factor authentication for the account, preferably with an authenticator app or a security key rather than SMS. Check the account's recovery email, phone number and any automatic forwarding rules, because attackers sometimes change these to keep access. If you entered banking or card details, contact your bank right away so they can block the card or monitor the account. Finally, report the message as phishing in your email service so it can protect others. Habits that protect you every day A password manager helps in two ways: it lets you use a different strong password for every site, and it usually will not fill in a login on a fake lookalike page, which can be a useful warning sign. Keep your operating system, browser and apps updated, since updates close security holes that attackers rely on. Finally, slow down. Almost every phishing attempt depends on speed and distraction, and a pause of a few seconds to check the sender and the link is often enough to stop it. Sumber: SHP News