01 / Understand
What is happening?
Phishing is a deceptive message or website that tries to get you to reveal sensitive information, send money or install something harmful. It can arrive by email, text, social media or a QR code. A polished design and correct spelling do not make a request trustworthy.
Instead of judging only how a message looks, verify what it asks you to do. Open the official app or type a known address yourself. If someone asks you to bypass a normal payment or sign-in process, slow down and check through another channel.
02 / Act without spending
Your free first steps
- 01
Verify without using the message’s links.
Open your bank or service’s app yourself. For a work-related request, check with the sender using an established contact method. Do not share one-time security codes with a caller or messenger.
- 02
Use unique passwords and stronger sign-ins.
Enable multifactor authentication. Use passkeys or security keys where supported. A password manager may help you notice a lookalike domain when it will not offer the expected saved login.
- 03
Report the message, then delete it.
Use your email provider’s report-phishing option. At work, follow the organization’s reporting process. Do not forward dangerous links casually to friends or colleagues.
CISA phishing guidance - 04
Act on what you actually shared.
If you entered a password, change it on the real site and end unfamiliar sessions. If you shared payment details or sent money, call the bank or provider. If you downloaded a file, update your device and run its available security checks.
An important reality check
What tools cannot promise
A VPN does not prevent phishing. Email filters and security apps can miss deceptive messages. Multifactor authentication helps but some codes and approval prompts can still be tricked out of you; never approve a sign-in you did not initiate.
03 / Common questions
A few things worth knowing
Does the padlock mean a website is legitimate?
No. HTTPS encrypts the connection to that website; it does not prove the website’s operator is honest. A phishing website can also use HTTPS. Check the destination and reach the service independently.
Can a VPN stop phishing messages?
No. A VPN changes how your connection is routed. It does not make a deceptive email, text or login page trustworthy and does not protect a password you give to a scammer.
What if I clicked but did not enter information?
Close the page and do not download or run anything. Keep the browser and device updated. If you downloaded a file, granted permissions or notice unusual activity, use the device’s security checks and seek trusted support. Clicking alone does not tell you exactly what happened.
Further help from official sources
These are established guidance resources, not a claim of new research or an endorsement of any paid tool. Check the official pages for current instructions.