Phishing: How to Spot It, Stop It and Report It
Phishing: spot it, stop it, report it.
Phishing is still the easiest way into most organisations. This guide shows what modern phishing looks like, a 30-second check anyone can do, what to do if you already clicked, and where to report it.
What phishing looks like today
Phishing is any message that tricks you into handing over a password, money, data or access. In the FBI’s 2025 Internet Crime Report, phishing and spoofing was again the most reported crime type, with 191,561 complaints. Business email compromise (BEC), where criminals pose as a boss, colleague or supplier to redirect payments, caused about $3 billion in reported losses.
- Email phishing: fake invoices, delivery notices, shared documents and password-expiry warnings that lead to a fake login page.
- Smishing and vishing: the same tricks by text message or phone call, often claiming to be your bank, a courier or IT support.
- QR-code phishing: a QR code in an email, letter or poster that opens a fake login or payment page on your phone, away from your company’s filters.
- Business email compromise: no link or attachment at all, just a convincing request to change bank details or buy gift cards, sometimes sent from a real but hacked account.
- MFA fatigue: a flood of sign-in approval prompts, sent in the hope that you tap “Approve” to make them stop.
AI tools now help criminals write fluent, personalised messages in any language, so spelling mistakes are no longer a reliable warning sign. Judge the request, not the grammar.
Red flags
| Signal | What it looks like | What to do |
|---|---|---|
| Urgency or fear | “Your account closes today”, “Pay within the hour”, “Legal action” | Slow down. Real organisations give you time. |
| A change of payment details | A supplier or colleague says their bank account has changed | Call them on a number you already have, never one in the message. |
| Unexpected login request | A link to “view the document” or “confirm your password” | Open the app or website yourself instead of using the link. |
| Look-alike sender or link | micros0ft-support.com, a free webmail address for a company, a reply-to that differs from the sender | Check the full address and hover over links before clicking. |
| Secrecy | “Don’t tell anyone, I’m in a meeting”, gift-card requests | Any request to bypass normal process is a reason to verify. |
| Prompts you didn’t start | An MFA approval or a password-reset code you never asked for | Deny it and change your password. Someone already has it. |
The 30-second check
- Pause. Ask: was I expecting this, and does it ask me to act fast?
- Check the sender. Look at the full email address or phone number, not just the display name.
- Inspect links without clicking. On a computer, hover; on a phone, press and hold. The real domain is the part just before the first single slash.
- Go direct. Type the website address yourself, or open the official app, and look for the same message there.
- Verify money and access requests by phone using a number from your own records.
- Never approve an MFA prompt or share a code you did not request, even if the caller says they are from IT or your bank.
I clicked: now what?
Mistakes happen, and speed matters more than blame. Report quickly so damage can be limited.
- If you entered a password: change it immediately from a trusted device, and anywhere else you reused it. Sign out of all sessions if the service allows it.
- If you opened an attachment or installed something: disconnect the device from the network (Wi-Fi off or cable out) but leave it powered on, then call IT.
- If you approved an MFA prompt or shared a code: tell IT or the provider now. They can revoke the session.
- If money was sent: call your bank straight away and ask for a recall. In the US, also file at ic3.gov. Fast reporting gives the best chance of freezing funds.
- Check your mailbox rules. Attackers often add hidden forwarding or “move to folder” rules to watch your email. Remove any you did not create.
Where to report
- At work: use the “Report phishing” button in your email client, or forward the message to your IT or security team. Reporting protects your colleagues.
- Anywhere: forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.
- Scam texts: in the US and UK, forward the message to 7726 (it spells SPAM) so mobile networks can block the sender.
- United States: report fraud at ReportFraud.ftc.gov; report losses or BEC to the FBI at ic3.gov.
- United Kingdom: forward suspicious emails to report@phishing.gov.uk.
- Elsewhere: report to your national CERT or cybercrime police unit, and to the company being impersonated.
For organisations: make phishing fail
- Phishing-resistant MFA (FIDO2 security keys or passkeys) for email, VPN, remote access and every admin account. See passwords, passkeys & MFA.
- SPF, DKIM and DMARC on every domain you own, moving DMARC towards
p=rejectonce reports show legitimate mail is aligned. Check your domain with our email security checker. - A payment-change process that always requires a call-back to a known number and a second approver.
- External-sender banners and a one-click report button, with quick feedback to people who report.
- Short, regular awareness training and realistic simulations. Never shame people who click; reward fast reporting.
- Least privilege, so one stolen account cannot reach everything.
Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026); CISA, Implementing Phishing-Resistant MFA; APWG, Report Phishing; UK NCSC, Suspicious Email Reporting Service. Reviewed November 2026.
MAG212 CYBER offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.