{"id":3812,"date":"2026-11-01T15:22:31","date_gmt":"2026-11-01T23:22:31","guid":{"rendered":"https:\/\/cyber.mag212.com\/learn\/phishing-guide\/"},"modified":"2026-11-01T15:29:04","modified_gmt":"2026-11-01T23:29:04","slug":"phishing-guide","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/phishing-guide\/","title":{"rendered":"Phishing: How to Spot It, Stop It and Report It"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-phishing\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Learn \u00b7 Security<\/div>\n<h2>Phishing: <span>spot it, stop it, report it.<\/span><\/h2>\n<p>Phishing is still the easiest way into most organisations. This guide shows what modern phishing looks like, a 30-second check anyone can do, what to do if you already clicked, and where to report it.<\/p>\n<div class=\"toc\"><a href=\"#what\">What it looks like<\/a><a href=\"#signs\">Red flags<\/a><a href=\"#check\">30-second check<\/a><a href=\"#clicked\">I clicked: now what?<\/a><a href=\"#report\">Where to report<\/a><a href=\"#org\">For organisations<\/a><\/div><\/section>\n\n<section class=\"sec\" id=\"what\"><h3>What phishing looks like today<\/h3>\n<p>Phishing is any message that tricks you into handing over a password, money, data or access. In the FBI&#8217;s 2025 Internet Crime Report, phishing and spoofing was again the most reported crime type, with 191,561 complaints. Business email compromise (BEC), where criminals pose as a boss, colleague or supplier to redirect payments, caused about $3 billion in reported losses.<\/p>\n<ul class=\"l\">\n<li><b>Email phishing:<\/b> fake invoices, delivery notices, shared documents and password-expiry warnings that lead to a fake login page.<\/li>\n<li><b>Smishing and vishing:<\/b> the same tricks by text message or phone call, often claiming to be your bank, a courier or IT support.<\/li>\n<li><b>QR-code phishing:<\/b> a QR code in an email, letter or poster that opens a fake login or payment page on your phone, away from your company&#8217;s filters.<\/li>\n<li><b>Business email compromise:<\/b> no link or attachment at all, just a convincing request to change bank details or buy gift cards, sometimes sent from a real but hacked account.<\/li>\n<li><b>MFA fatigue:<\/b> a flood of sign-in approval prompts, sent in the hope that you tap &#8220;Approve&#8221; to make them stop.<\/li>\n<\/ul>\n<p>AI tools now help criminals write fluent, personalised messages in any language, so spelling mistakes are no longer a reliable warning sign. Judge the <b>request<\/b>, not the grammar.<\/p><\/section>\n\n<section class=\"sec\" id=\"signs\"><h3>Red flags<\/h3>\n<table><tbody><tr><th>Signal<\/th><th>What it looks like<\/th><th>What to do<\/th><\/tr>\n<tr><td>Urgency or fear<\/td><td>&#8220;Your account closes today&#8221;, &#8220;Pay within the hour&#8221;, &#8220;Legal action&#8221;<\/td><td>Slow down. Real organisations give you time.<\/td><\/tr>\n<tr><td>A change of payment details<\/td><td>A supplier or colleague says their bank account has changed<\/td><td>Call them on a number you already have, never one in the message.<\/td><\/tr>\n<tr><td>Unexpected login request<\/td><td>A link to &#8220;view the document&#8221; or &#8220;confirm your password&#8221;<\/td><td>Open the app or website yourself instead of using the link.<\/td><\/tr>\n<tr><td>Look-alike sender or link<\/td><td>micros0ft-support.com, a free webmail address for a company, a reply-to that differs from the sender<\/td><td>Check the full address and hover over links before clicking.<\/td><\/tr>\n<tr><td>Secrecy<\/td><td>&#8220;Don&#8217;t tell anyone, I&#8217;m in a meeting&#8221;, gift-card requests<\/td><td>Any request to bypass normal process is a reason to verify.<\/td><\/tr>\n<tr><td>Prompts you didn&#8217;t start<\/td><td>An MFA approval or a password-reset code you never asked for<\/td><td>Deny it and change your password. Someone already has it.<\/td><\/tr>\n<\/tbody><\/table><\/section>\n\n<section class=\"sec\" id=\"check\"><h3>The 30-second check<\/h3>\n<ol class=\"l\">\n<li><b>Pause.<\/b> Ask: was I expecting this, and does it ask me to act fast?<\/li>\n<li><b>Check the sender.<\/b> Look at the full email address or phone number, not just the display name.<\/li>\n<li><b>Inspect links without clicking.<\/b> On a computer, hover; on a phone, press and hold. The real domain is the part just before the first single slash.<\/li>\n<li><b>Go direct.<\/b> Type the website address yourself, or open the official app, and look for the same message there.<\/li>\n<li><b>Verify money and access requests by phone<\/b> using a number from your own records.<\/li>\n<li><b>Never approve an MFA prompt or share a code<\/b> you did not request, even if the caller says they are from IT or your bank.<\/li>\n<\/ol>\n<div class=\"callout\"><b>Free tools to help:<\/b> paste a suspicious URL into our <a href=\"\/tools\/link-checker\/\">suspicious link checker<\/a>, inspect where an email really came from with the <a href=\"\/tools\/email-header-analyzer\/\">email header analyzer<\/a>, and test yourself with the <a href=\"\/tools\/phishing-quiz\/\">phishing quiz<\/a>.<\/div><\/section>\n\n<section class=\"sec\" id=\"clicked\"><h3>I clicked: now what?<\/h3>\n<p>Mistakes happen, and speed matters more than blame. Report quickly so damage can be limited.<\/p>\n<ol class=\"l\">\n<li><b>If you entered a password:<\/b> change it immediately from a trusted device, and anywhere else you reused it. Sign out of all sessions if the service allows it.<\/li>\n<li><b>If you opened an attachment or installed something:<\/b> disconnect the device from the network (Wi-Fi off or cable out) but leave it powered on, then call IT.<\/li>\n<li><b>If you approved an MFA prompt or shared a code:<\/b> tell IT or the provider now. They can revoke the session.<\/li>\n<li><b>If money was sent:<\/b> call your bank straight away and ask for a recall. In the US, also file at ic3.gov. Fast reporting gives the best chance of freezing funds.<\/li>\n<li><b>Check your mailbox rules.<\/b> Attackers often add hidden forwarding or &#8220;move to folder&#8221; rules to watch your email. Remove any you did not create.<\/li>\n<\/ol>\n<div class=\"callout\"><b>For businesses:<\/b> if you suspect a real breach, follow our <a href=\"\/learn\/incident-response-cheat-sheet\/\">incident response checklist for the first 60 minutes<\/a>.<\/div><\/section>\n\n<section class=\"sec\" id=\"report\"><h3>Where to report<\/h3>\n<ul class=\"l\">\n<li><b>At work:<\/b> use the &#8220;Report phishing&#8221; button in your email client, or forward the message to your IT or security team. Reporting protects your colleagues.<\/li>\n<li><b>Anywhere:<\/b> forward phishing emails to the Anti-Phishing Working Group at <b>reportphishing@apwg.org<\/b>.<\/li>\n<li><b>Scam texts:<\/b> in the US and UK, forward the message to <b>7726<\/b> (it spells SPAM) so mobile networks can block the sender.<\/li>\n<li><b>United States:<\/b> report fraud at ReportFraud.ftc.gov; report losses or BEC to the FBI at ic3.gov.<\/li>\n<li><b>United Kingdom:<\/b> forward suspicious emails to report@phishing.gov.uk.<\/li>\n<li><b>Elsewhere:<\/b> report to your national CERT or cybercrime police unit, and to the company being impersonated.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"org\"><h3>For organisations: make phishing fail<\/h3>\n<ul class=\"l\">\n<li><b>Phishing-resistant MFA<\/b> (FIDO2 security keys or passkeys) for email, VPN, remote access and every admin account. See <a href=\"\/learn\/passwords-mfa\/\">passwords, passkeys &amp; MFA<\/a>.<\/li>\n<li><b>SPF, DKIM and DMARC<\/b> on every domain you own, moving DMARC towards <code>p=reject<\/code> once reports show legitimate mail is aligned. Check your domain with our <a href=\"\/tools\/email-security-checker\/\">email security checker<\/a>.<\/li>\n<li><b>A payment-change process<\/b> that always requires a call-back to a known number and a second approver.<\/li>\n<li><b>External-sender banners<\/b> and a one-click report button, with quick feedback to people who report.<\/li>\n<li><b>Short, regular awareness training<\/b> and realistic simulations. Never shame people who click; reward fast reporting.<\/li>\n<li><b>Least privilege,<\/b> so one stolen account cannot reach everything.<\/li>\n<\/ul>\n<p class=\"small\">Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026); CISA, Implementing Phishing-Resistant MFA; APWG, Report Phishing; UK NCSC, Suspicious Email Reporting Service. Reviewed November 2026.<\/p><\/section>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<\/div>\n<style>.m212toc,.m212more{font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:#e6edf3;box-sizing:border-box}.m212toc{background:#0f1720;border:1px solid #1f2d3a;border-radius:12px;padding:14px 18px;margin:0 0 22px}.m212toc summary{cursor:pointer;font-weight:800;font-size:15px;list-style:none;display:flex;justify-content:space-between;align-items:center;gap:10px}.m212toc summary::-webkit-details-marker{display:none}.m212toc summary span{font-size:12px;font-weight:700;color:#9fb0c0}.m212toc summary::after{content:\"\u25be\";color:#3cc8f0;margin-left:auto}.m212toc details:not([open]) summary::after{content:\"\u25b8\"}.m212toc ol{margin:12px 0 0;padding:0 0 0 20px;columns:2 260px;column-gap:28px}.m212toc li{margin:0 0 6px;break-inside:avoid;font-size:14px;color:#9fb0c0}.m212toc a{color:#3cc8f0;text-decoration:none}.m212toc a:hover{text-decoration:underline}h2[id^=\"m212s-\"]{scroll-margin-top:110px}.m212more{display:flex;flex-wrap:wrap;gap:10px;margin:28px 0 8px;padding:16px;background:#0f1720;border:1px solid #1f2d3a;border-radius:12px}.m212more a{flex:1 1 200px;display:block;text-decoration:none;color:#e6edf3;background:#121c27;border:1px solid #2a3b4b;border-radius:10px;padding:10px 14px;font-size:14px;font-weight:700}.m212more a small{display:block;font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#3ee6a0;margin-bottom:2px}.m212more a:hover{border-color:#3cc8f0}<\/style><nav class=\"m212more\" aria-label=\"Keep learning\"><a href=\"\/learn\/\"><small>Back to<\/small>All learning guides<\/a><a href=\"\/learn\/passwords-mfa\/\"><small>Next \u2192<\/small>Passwords, passkeys &amp; MFA<\/a><a href=\"\/learn\/incident-response-cheat-sheet\/\"><small>Related<\/small>Incident response: first 60 minutes<\/a><\/nav>\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Learn \u00b7 Security Phishing: spot it, stop it, report it. Phishing is still the easiest way into most organisations. This guide shows what modern phishing looks like, a 30-second check anyone can do, what to do if you already clicked, and where to report it. What it looks likeRed flags30-second checkI clicked: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3812","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3812","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3812"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3812\/revisions"}],"predecessor-version":[{"id":3830,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3812\/revisions\/3830"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3812"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}