How to Spot Phishing | Steps to Check Fake Emails and Fake Websites
Missed-delivery notices, card usage alerts, warnings that your account will be suspended. Phishing is built on “messages that rush you” and “screens that look exactly like the real thing”. This guide sets out the checks you can use to decide on the spot, and what to do if you have already opened one.
How phishing works
Phishing is a trick that sets up a login page identical to the real one, lures you there and gets you to type in your details. It isn't a technically advanced attack; what decides whether it works is how the message is written. What these messages have in common is that they are built so you don't have time to think.
- They set a deadline: “If you do not respond within 24 hours, your account will be suspended”
- They hint at a loss: “Unauthorised use has been detected”, “Your parcel will be returned”
- They make it look like little effort: “Just confirm via the link below”
- They are short: deliberately giving you less to judge by
- They use real company names: familiar logos and colours remove any sense that something is off
Put the other way, simply stopping the moment you feel rushed prevents most of it. If a notice is genuinely important, you should see the same thing when you go in again through the official app or your bookmark. Having a way to check without tapping links in emails or text messages is the most reliable defence.
The order of checks when you open an email or text message
- 1
1. Read the sender's domain all the way to the end
The display name can be set to anything, so look at what comes after the “@”. A classic trick is to put the real domain at the front and hang it off a different domain, as in amazon.co.jp.example.com. The basic rule is to read a domain from the right.
- 2
2. Check the link's URL without tapping it
On a computer, hover over the link to see it. On a phone, long-press to preview it. Again, look at the right-hand end of the domain.
- 3
3. Compare it with your own situation
A parcel you didn't order, a service you don't use, a payment you don't recognise. If the premise doesn't fit, there is no need to read further.
- 4
4. Check through the official route without tapping the link
Open the official app or your own bookmark. If action really is needed, the same notice will be there too.
- 5
5. If you can't decide, contact the official support desk
Call the number listed on the official website, not the one written in the email. Act on the assumption that even the contact details have been faked.
| What you see | Genuine? | Why |
|---|---|---|
| support@example.co.jp | Something to judge by | Check whether the right-hand end of the domain is official |
| example.co.jp.secure-login.com | Fake | The real domain is secure-login.com |
| examp1e.co.jp (l replaced by 1) | Fake | Swapping in look-alike characters |
| Shortened URL | Can't tell | You can't see where it leads, so don't tap it as is |
| “It has a padlock” | Not evidence | Anyone can install a free certificate |
The fifth row is a particularly common misunderstanding. The padlock (HTTPS) only shows that “the connection is encrypted”. Fake sites can get one too, so it is no proof of safety. What you judge by is the domain name itself.
What to check when a login page appears
Even if you have opened the link, no harm is done as long as you haven't typed anything. When a login page appears, check the following before you enter anything.
- Read the domain in the address bar from the right. Are the last two parts the official ones, rather than a subdomain?
- If your password manager doesn't autofill, the URL is very likely different from the one you saved
- Unnatural wording, fonts or spacing that differ from the official site, many links that don't work
- It asks for lots of personal information at once: your PIN, the security code on the back of your card and your bank account number on the same page
- Information that should only appear after you log in is shown before you log in
There is also a trick that extracts your two-factor authentication code. The attacker immediately feeds the ID and password you entered on the fake site into the real site, then gets you to enter the code that arrives as well. Even when a page says “Enter your code”, you need to check separately whether that page is genuine.
What to do if you have entered your details
As soon as you notice, take these steps in order. Trying to do everything at once in a panic leads to gaps, so work through them from the top.
- 1
1. Change the password for that service
Change it by going in again through the official app or your bookmark, not from the fake site. If you can no longer log in, go to the next step.
- 2
2. Also change it on other services where you reuse the same password
This is where the damage spreads. The same combination will be tried on other services, so change every one you can think of.
- 3
3. Turn on two-factor authentication
Make sure there is an extra check even if your password leaks. Using an authenticator app is stronger than SMS.
- 4
4. If you entered card details, contact your card company
Ask them to stop the card and reissue it. Use the contact details on the back of the card or the official website, never the number in the email.
- 5
5. Check your login history and connected apps
Look for logins you don't recognise, and connected apps or forwarding settings added without your knowledge. Automatic email forwarding settings are especially easy to miss.
- 6
6. Get advice if needed
If you have lost money, or if a work account is involved, contact the police consultation service for cybercrime or your organisation's information security team.
When you create a new password, don't make it a slightly altered version of the old one. A leaked password becomes the starting point for guesses. Assigning a randomly generated string to each service separately is the reliable way.
Settings to prepare for next time
| Measure | Effect | Effort |
|---|---|---|
| A different password for each service | One leak doesn't spread | Needs a password manager |
| Two-factor authentication (authenticator app) | A password alone can't get in | One-time setup only |
| The habit of going in through the official app or bookmarks | You don't tap lure links | Just a habit |
| Turn on payment notifications | You notice unauthorised use sooner | One-time setup only |
| Password manager autofill | You don't type into fake domains | One-time setup only |
The first row has the biggest effect. The real damage from phishing spreads when the stolen combination is tried on other services. If you assign a random string to each service, the damage stops at that one. A password generator lets you create one on the spot with the length and character types you specify.
- Deal with your most important accounts (email, payments, social media) first
- Your email account comes first of all. If it is taken over, it is used to reset other services
- Close accounts on services you no longer use. Having fewer things to manage is also a defence
- For accounts you share with family, stop sharing them or switch to a dedicated sharing method
FAQ
- Is a site safe if it has a padlock?
- No. The padlock only shows that the connection is encrypted; it doesn't show whether the operator is genuine. Anyone can get a certificate, so fake sites show a padlock too. What you should check is the domain name itself: read it from the right and see whether it is the official one.
- Is it dangerous just to open the email?
- Simply displaying the message doesn't normally cause harm straight away. The danger is opening the link and entering information, or opening attachments. However, loading images can tell the sender that you opened it, so it is safest to delete obvious scam emails without opening them.
- I opened the link but didn't enter anything.
- At that point, no information has been handed over. Close the page and ignore any notices from that site. To be safe, check that service's login history through the official app and make sure there are no logins you don't recognise.
- I entered my password. What should I do first?
- First change that service's password through the official app or your bookmark, then change it on every other service where you reuse the same password. Next, turn on two-factor authentication. If you also entered card details, contact your card company using the number on the back of the card.
Tools in this article
Related articles
What Is a Passkey? How It Differs from a Password, and How to Set One Up
Plenty of people have seen a sign-in screen ask "Create a passkey?" and simply closed it. This guide explains how a passkey differs from a password, why it stands up to phishing, how to set one up, and what to watch out for when you switch phones.
Read article →How to Manage Your Passwords: Choosing Where to Store Them and How to Switch
Everyone says to use a different password for every account, but you can't remember them all, so you end up reusing them. The problem isn't the passwords themselves — it's where you keep them. This guide compares the ways to store passwords, what each is good and bad at, and the steps to move from where you are now to a safer setup.
Read article →What Is Two-Factor Authentication? Which Accounts to Secure First and How Strong Each Method Is
Even if your password leaks, two-factor authentication stops most unauthorized logins. This guide covers how strong each authentication method is, which services to set it up on first, and how to keep backups so you don’t get locked out when you change phones.
Read article →