How to Recognize Phishing Text Messages and Fake Sites

Before you start

Do not begin with a broad reset. Check the following first so you can isolate the problem and avoid unnecessary data loss or reconfiguration.

• Do not sign in or pay through an SMS link
• A sender name alone does not prove authenticity
• Be cautious of urgency, shortened URLs and attached apps

Understand the process

Safe step-by-step procedure

Work from the top and stop as soon as the issue is resolved. Read every confirmation screen before moving to a higher-impact action.

1. 1
   Do not tap the message link; check the claim through the official app or a bookmark you created yourself.
2. 2
   Read the full domain and look for character substitutions, misleading subdomains and shortened URLs.
3. 3
   Do not enter passwords, card data or one-time codes requested by the message.
4. 4
   If you only opened the page, close it and check that nothing was downloaded and no profile was installed.
5. 5
   If you entered credentials, change the password immediately from the official site, update reused passwords, and review sessions and two-step verification.
6. 6
   If you entered card data, contact the card issuer; if you installed an app, disconnect and seek official support.
7. 7
   Report the message as spam and preserve only the evidence needed.

Actions to avoid

• Trusting a message because the sender name resembles a company
• Using a search advertisement and landing on another fake page
• Deleting all evidence before reviewing what happened

Prevention and preparation

• Use unique passwords with a password manager
• Enable two-step verification for important accounts