Training module
Recognising phishing and fake messages
The pressure patterns behind most fake messages, a calm routine for checking them and how to report one.
What you will be able to do
- Spot the three signals most fake messages share.
- Check a link and a sender without opening anything.
- Know what to do after clicking or entering a password.
The pattern behind it
Phishing works on the situation, not on the technology. The message creates urgency, borrows an authority and asks for one quick action: click, sign in, pay, open an attachment. Whatever the channel, e-mail, SMS, a chat app or a phone call, the structure is the same.
Three signals worth stopping for
None of these proves a message is fake, and a message can be fake without any of them. Together they are a reason to slow down.
- Urgency or threat: an account about to close, a payment overdue, a parcel returned.
- An unexpected request from a known name: a colleague asking for gift cards, a supplier with new bank details.
- A link or attachment you did not ask for, leading somewhere you must sign in.
A calm routine
Do not answer inside the message. Leave it and go to the service yourself, by typing the address or using its app. If a message claims to be from your bank, look in the bank's own app. If it asks for a payment, confirm through a number you already hold, not one printed in the message.
Reading a link without opening it
The part that identifies the owner is the registered domain, read from the right of the host name: in login.example.com.verify-now.net the owner is verify-now.net. Look for a real host hidden after an @ sign, a brand name used as a subdomain and characters that only resemble letters. The link tool in this section splits any address you paste, without visiting it.
If you already clicked
Clicking alone rarely does harm, and panic helps no one. If you entered a password, change it at once on the genuine site, and on every other site where you used it. Turn on multi-factor authentication, check recent sign-ins, and tell your organisation's security contact if it was a work account. If you opened an attachment and something unusual happened, disconnect the device from the network and ask for help.
Key points
- Urgency, borrowed authority and a quick action are the pattern.
- Leave the message and go to the service yourself.
- Act fast after a mistake: change the password, enable MFA, report.
Check yourself
Choose an answer to see the explanation. You can start again at any time.
1. Which is the safest first move when a message from your bank warns of a blocked account?
You check through a channel you chose, never through the one the message provided.
2. In http://paypal.com@pay-check.example.net/login, which host will the browser connect to?
Everything before the @ is treated as a user name. The host is what follows it.
3. You typed your password into a page you now doubt. What comes first?
The attacker may use the password within minutes. Changing it removes their access; history does not.
Go further
Sources
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).