Every day, millions of fake messages land in inboxes and on phones. They look like they come from your bank, a parcel company, or even a friend, and they all want the same thing: your passwords, your money, or your personal details. This guide shows you how to spot phishing SMS and emails in 2026, what the newest tricks look like, and what to do if you already clicked.
What Is Phishing, in Plain Words?
Phishing is when a criminal pretends to be someone you trust so you will hand over something valuable. The name comes from “fishing,” because the scammer throws out bait and waits for someone to bite. The bait is usually a message with a link, a file, or a phone number to call.
When the fake message arrives as a text, people call it “smishing” (SMS plus phishing). When it comes as a phone call, it is called “vishing” (voice phishing). The names differ, but the goal never changes: trick you into acting before you think.
Why Phishing Looks Different in 2026
A few years ago, most scam messages were easy to catch because of bad spelling and strange grammar. That is no longer true. Scammers now use AI writing tools, which means fake messages can be polished, friendly, and written in perfect English or any other language.
Criminals also use stolen data from past breaches. A breach is when a company’s customer records leak online. With that data, a scammer can include your real name, your city, or the last few digits of your card, which makes the message feel genuine.
Other trends to know about this year include:
- QR code phishing: emails or posters with a QR code that sends you to a fake login page. Your email filter cannot easily read the code, so it slips through.
- Voice cloning: a call or voice note that sounds like a family member asking for urgent help with money.
- Messaging app scams: “Hi Mum, this is my new number” texts on chat apps, where the scammer pretends to be your child or a friend.
- Fake security alerts: messages saying your account was “locked” and asking you to share a one-time code to unlock it.
The Classic Warning Signs Still Matter
Even though scams look more polished, they still follow the same playbook. If you learn the core warning signs, you can catch most fake messages no matter how well they are written.
- Urgency or fear: “Act within 24 hours,” “Your account will be closed,” or “Final notice.” Pressure is designed to stop you from thinking clearly.
- A request for sensitive details: real banks and services do not ask for your full password, PIN, or one-time code by text or email.
- Something you did not expect: a parcel you never sent for, a refund you never asked about, or a prize from a contest you never entered.
- Odd payment methods: requests to pay with gift cards, crypto, or a money transfer app are a huge red flag.
- A generic greeting: “Dear customer” or “Hello user” can still be a clue, even if some scams now use your real name.
How to Spot a Fake Text Message (SMS)
Text messages feel personal, so people tend to trust them more than emails. Scammers know this. A text is also short, which leaves you less information to judge, so you need to look closely at the few clues you do get.
Start with the sender. Many fake texts come from a random mobile number or an email address instead of the short code a real company normally uses. However, scammers can sometimes fake the sender name, so a familiar name alone does not prove anything.
Next, look at the link. Common smishing links use shortened addresses, odd spellings of a company name, or extra words like “secure,” “verify,” or “update” stuck onto the web address. If a text about a package, a toll charge, or a tax refund includes a link, treat it with suspicion.
- The message arrives late at night or at odd hours.
- It mentions a small unpaid fee, such as a missed toll or a re-delivery charge.
- It says “reply Y” or asks you to copy the link into your browser. Replying tells the scammer your number is active.
- It comes from “a friend” on a new number who quickly asks for money.
If you tapped a strange link and your phone has started acting oddly, such as draining battery fast or showing pop-ups, read our guide on the signs your phone has a virus to check for problems.
How to Spot a Phishing Email
Emails give scammers more space to look official. They copy company layouts, colors, and footers. That is why you should look past the design and check the details underneath.
First, check the real sender address, not just the display name. On a computer, hover your mouse over the name. On a phone, tap the name to reveal the full address. A message that claims to be from your bank but comes from a free email account or a strangely spelled domain is fake. A domain is the part of the address after the @ sign.
Second, check links before you click. Hover over a link on a computer, or press and hold it on a phone, to preview where it really goes. If the address does not match the company’s official website exactly, do not open it.
- Unexpected attachments: files like invoices, “scanned documents,” or zipped folders you were not expecting can carry malware, which is harmful software.
- Login requests: a button that says “Sign in to view your message” often leads to a copycat login page built to steal your password.
- Reply-to tricks: the email looks like it is from your boss or a colleague, but hitting reply would send your answer to a different address.
- Changed bank details: a “supplier” or “landlord” telling you their account number has changed is a common and costly scam.
A Simple Three-Step Check Before You Act
You do not need to be a tech expert to stay safe. When any message asks you to click, pay, or share, use this quick routine.
- Stop: pause for a moment. Real companies can wait a few minutes. Scammers cannot, which is why they rush you.
- Check: contact the company yourself using its official app, a website you type in by hand, or the phone number on the back of your card. Never use the contact details inside the suspicious message.
- Confirm: if a friend or family member asks for money, call them on the number you already have saved. Agree on a family “safe word” for emergencies so a cloned voice cannot fool you.
Settings That Block Many Scams Automatically
Your phone and email already include tools that filter out a lot of fake messages. Turning them on takes only a few minutes and can save you a great deal of trouble.
- Spam and scam filters: most phones can filter texts from unknown senders into a separate folder. Turn this on in your messaging settings.
- Two-factor authentication (2FA): this adds a second step, like a code or an app approval, when you log in. Even if a scammer steals your password, they still cannot get in easily.
- Passkeys: a passkey is a newer way to sign in using your fingerprint, face, or device PIN instead of a password. Passkeys cannot be typed into a fake website, so they block most phishing.
- Software updates: keep your phone, browser, and apps updated, because updates often fix security holes.
- A password manager: it only fills in your password on the real website, so it quietly warns you when a page is fake.
For a wider set of habits that protect your accounts and devices, see our list of top cybersecurity tips.
What to Do If You Clicked a Phishing Link
Clicking a bad link happens to careful people too, so do not panic. Acting quickly matters more than feeling embarrassed. Follow these steps as soon as you can.
- Do not enter anything else. Close the page right away if you have not typed any details yet.
- Change your password. If you entered a password, change it on the real website, and change it anywhere else you used the same one.
- Call your bank. If you shared card or bank details, call the number on your card and ask them to block it.
- Turn on 2FA. Add two-factor authentication to any account that might be affected.
- Scan your device. Run a security scan and remove any apps you do not recognize, especially if you downloaded a file.
- Watch your accounts. Check your bank statements and email for strange activity over the next few weeks.
How to Report Fake Messages
Reporting helps protect other people. Many phone carriers let you forward scam texts to a short reporting number, often 7726, which spells “SPAM” on a keypad. Check your carrier’s help page to confirm the right number where you live.
For emails, use the “Report phishing” or “Report spam” option in your email app rather than simply deleting the message. You can also report scams to your national consumer protection or cybercrime agency. If a scam pretends to be a specific company, that company usually has a page explaining how to report fakes that use its name.
Teach the People Around You
Scammers often target older relatives, teenagers, and anyone new to smartphones. A short chat about the warning signs can protect the people you care about. Show them how to check a sender, how to preview a link, and remind them that it is always fine to hang up and call back.
Make it a family rule that nobody sends money or codes based on a message alone. Pair that rule with the habits in our top cybersecurity tips guide, and your whole household will be much harder to fool.
Frequently Asked Questions
Can I get hacked just by opening a phishing text or email?
In most cases, simply opening a message is not enough to cause harm. The danger usually comes from tapping links, opening attachments, or replying with details. Keeping your phone and apps updated lowers the risk even further.
Why do phishing messages use my real name?
Scammers often buy or collect data from past company breaches. That data can include your name, email, phone number, and address. Seeing your real name does not mean a message is genuine, so always check the sender and links.
Should I reply “STOP” to a scam text?
No. Replying to a scam text tells the sender that your number is active, which can lead to even more scam messages. Instead, report the message and block the number.
Are QR codes safe to scan?
QR codes are just shortcuts to web addresses, so they are only as safe as the link behind them. Before opening the page, look at the address preview your camera shows. Be extra careful with QR codes in unexpected emails or on stickers placed over signs in public places.
Will my bank ever ask for my one-time code?
A real bank will not call, text, or email you asking you to read out a one-time code. Those codes are only for you to type into the bank’s own app or website. If anyone asks for one, end the contact and call your bank using the number on your card.
