How to protect yourself from phishing
Last reviewed by Phish Takedown
The best defence against phishing is not memorising every scam. New stories and copied websites appear all the time. It is more useful to build a few habits that still work when the message looks convincing.
When a message asks you to sign in, make a payment, or check an account warning, leave the message and open the service another way. Use its official app, a saved bookmark, or an address you already know.
If the problem is real, it will usually be visible inside the account. This simple change avoids many fake links without requiring you to decide whether every message is genuine.
The same rule applies to phone numbers. Call a bank, delivery company, or government service using a number from its official website or your card, not the number in an unexpected message.
Passwords and account security
Use a different password for every account. A password manager can create and store them, and it will normally offer a saved login only on the correct website. That makes an unfamiliar domain easier to notice.
Turn on multifactor authentication where you can. An authenticator app or security key generally gives stronger protection against phishing than a code sent by text. Passkeys are also designed so they cannot be entered into a fake site in the same way as a password.
No second factor makes every action safe. A scammer can still ask you to read out a code, approve a notification, or scan a login QR code. Only approve a login that you started.
Browser and operating-system updates close security problems that a malicious page or attachment might use. Install apps and extensions only from sources you trust, and remove ones you no longer need.
Security warnings should not be treated as obstacles to click through. If a browser blocks a page, close it. If a message tells you to disable protection, paste a command, or install a special tool before support can help you, stop the conversation.
Support staff do not need your password, one-time code, backup code, or wallet recovery phrase. A recovery phrase gives control of the wallet to whoever has it. There is no safe reason to paste one into a website reached through an unexpected message.
Before filling in a form, ask why that information is needed for the task. A parcel tracking page should not need an email password. A community verification page should not need payment details. When the request does not fit, leave.
Check that your important accounts have a current recovery email address and phone number. Save recovery codes somewhere secure and separate from the device you normally use. Review active sessions and connected apps from time to time, especially for email and financial accounts.
These steps are easier to take before an incident than during one.
When a suspicious message arrives
Do not reply or use its contact details. Keep the message long enough to report it through the email or messaging service, then block the sender if appropriate. Copy a suspicious website address without opening it and send it to Phish Takedown.
If you already clicked, typed something, approved a login, or downloaded a file, follow what to do next. The right response depends on which of those things happened.