What it is
Phishing uses fake emails — and smishing fake text messages — that copy real organisations to trick you into clicking a link and entering passwords, card details or one-time codes on a fraudulent website.
How it works
- You receive a message about a parcel, unpaid toll, tax refund, account lock or prize.
- A link takes you to a copy of a real website.
- You enter login, card or personal details, which go straight to the criminal.
- The details are used immediately or sold, sometimes followed by a call from a fake “fraud team”.
Red flags
- Small, urgent payments (“pay £1.99 to rebook delivery”).
- Links with odd spellings or extra words in the address.
- Generic greetings and pressure to act quickly.
- Requests for codes sent to your phone.
A real-world example
The FBI’s Internet Crime Complaint Center has warned about mass text campaigns impersonating toll operators across many US states, built with “phishing-as-a-service” kits that let criminals send millions of messages.
How to protect yourself
- Don’t click links in unexpected messages; type the website address yourself.
- Turn on two-factor authentication, preferably with an app or passkey.
- Forward scam texts to your phone network (7726 in the UK and US).
- Use a password manager — it won’t autofill on fake sites.
If it happened to you
- If you entered card details, call your bank and cancel the card.
- If you entered a password, change it everywhere you used it and turn on two-factor authentication.
- Watch for follow-up calls pretending to be your bank’s fraud team.
- Report the message to your national reporting service.
Step-by-step help by country: I’ve been scammed — what now?
The rules
Singapore’s Shared Responsibility Framework requires telcos to block SMS from unregistered senders, and Australia’s Scams Prevention Framework covers telecoms. Many countries now require sender-ID registration for business texts.
Source: www.ic3.gov
