Recognizing Phishing Messages Before Sharing Passwords or Payment Details
Recognise phishing requests, verify through trusted channels and respond appropriately if passwords, payment details or access have been exposed.
On this page
- Identify the action the message wants
- Recognise pressure without relying on spelling mistakes
- Verify independently instead of replying
- Treat passwords and authentication codes carefully
- Handle links, attachments and QR codes consistently
- Report the message through the appropriate channel
- Act promptly if you already responded
- Common questions
- Sources and references
A phishing message tries to make you trust a false request: sign in, pay an unexpected charge, open a file or share a security code. It may look polished and appear to come from a familiar organisation. The safest decision is often to verify the request through a route you already trust before taking the requested action.
This guide explains a practical checking process for everyday messages. It is general guidance, not a guarantee that every malicious message can be recognised visually. If an incident involves a work account or device, follow the organisation’s reporting process and involve its support team promptly.
Identify the action the message wants
Before studying the design, ask what you are being asked to do. A notice that demands a password, payment, download or authentication code deserves closer scrutiny than its familiar logo might suggest. Write the requested action in plain language: “enter my bank details through this link” makes the decision clearer than “confirm my account”.
The US Federal Trade Commission’s phishing guidance describes messages that use stories about account problems, payments or other events to prompt action. An unexpected request can be suspicious even when you genuinely use the named service. Having an account is a reason to verify through that account’s trusted route, not a reason to trust every message bearing its name.
Consider whether you were expecting the particular event. If you recently ordered a parcel, a delivery message may seem plausible, but the coincidence does not authenticate a new payment link. Treat contextual relevance as one fact rather than proof of the sender’s identity.
Recognise pressure without relying on spelling mistakes
A short deadline, threat of suspension or unusually attractive reward can push you to act before checking. Pause when the message tries to make verification feel impossible. A genuine service issue can usually be investigated through its official account or support route without using the contact details supplied in the suspicious request.
Australia’s official phishing guidance notes that messages can look authentic and use convincing logos and wording. It also covers requests delivered through different channels, including QR codes and calls. Good grammar, a professional layout or personal details do not establish that the request is legitimate.
Look for a mismatch between the claimed purpose and the requested information. A message about a small delivery fee should not cause you to disclose an account password or a one-time sign-in code. You do not need to prove the entire fraud mechanism before deciding to stop and verify.
| Message asks you to | Question to ask | Verification route |
|---|---|---|
| Fix an account problem | Does the issue appear in my real account? | Open the known app or website independently |
| Pay new bank details | Has the intended recipient confirmed the change? | Use a previously known contact method |
| Share a security code | Am I being asked to authorise access I did not initiate? | Stop and contact the service through a trusted route |
| Open an unexpected file | Was this file actually requested or expected? | Confirm with the sender independently |
| Scan a QR code | Why should I trust this destination? | Use the service’s established access route instead |
Verify independently instead of replying
Use a known app, a previously saved legitimate bookmark or a website address you already know is correct. For telephone verification, use a trusted number from your existing records or the service’s established contact information. Do not use a replacement number supplied by the same suspicious message to “confirm” its own claim.
If a request appears to come from someone you know, contact them through a separate familiar route. A reply in the same conversation may reach whoever controls the account or address being used. Ask about the actual requested action, particularly if payment details have changed or the request is unusual for that person.
For example, an invented message says your account will close in thirty minutes unless you follow a link and enter a code. Instead of testing the link, open the service’s known app and check for the issue there. If you still need help, contact established support. The example deadline is part of the fictional scenario, not a typical phishing statistic.
Verification must use a separate trusted route
Suspicious route: message → supplied link or number → requested information.
Safer check: pause → open known app or contact → confirm the specific request.
Decision: act only after understanding the genuine issue and the appropriate next step.
Treat passwords and authentication codes carefully
A request to read out or forward a one-time code can be an attempt to complete a sign-in or payment. Do not share passwords or authentication codes with someone who contacts you unexpectedly. If the request is confusing, end the interaction and use the service’s normal support route.
Multi-factor authentication adds protection, but it does not make every request safe. Read prompts carefully and do not approve an action you did not initiate. Where a service offers passkeys or other security options, review its official setup guidance through the genuine account rather than following unsolicited setup instructions.
Keep account security separate from the message’s urgency. A caller who sounds confident or claims to be technical support does not gain authority to ask for access merely by explaining the process in detail. You can stop the conversation without needing to debate whether each statement is true.
Handle links, attachments and QR codes consistently
Do not open an unexpected attachment or scan a suspicious QR code just to see whether it is genuine. A QR code is another way of presenting a destination, not a mark of legitimacy. Ask why the file or destination is needed and verify the request through the known service or sender.
A visible address can provide clues, but a quick glance at a link is not a complete security assessment. Avoid building the whole decision around one visual feature. The practical alternative is to navigate independently to the service you intend to use, which also avoids needing to interpret every unfamiliar address format.
If the message concerns an international payment, use the same independently verified recipient details you would use in our money-transfer comparison guide. Price and speed comparisons are useful only after you know whom you intend to pay and have confirmed the instructions.
Report the message through the appropriate channel
The UK National Cyber Security Centre’s phishing collection provides routes for reporting different kinds of suspicious contact. Reporting processes vary by country and service. Use the relevant official route and the reporting features of your email or messaging provider, rather than assuming one country’s reporting system applies everywhere.
For work messages, use the organisation’s established process and give the support team the information it asks for. Avoid forwarding suspicious content casually to colleagues as a warning if that creates another opportunity for someone to open it. A factual report should identify what arrived and whether any action was taken.
Keep useful evidence without continuing the interaction. Record the time, claimed sender and what you clicked or shared, if anything. You do not need to send further replies to gather proof, and you should not publish passwords, codes or account details while asking other people for help.
Separate recognition, reporting and recovery
Recognition: stop before carrying out an unverified request.
Reporting: use the service, workplace or relevant official channel.
Recovery: respond to what was actually exposed, with the bank, account provider or support team.
Act promptly if you already responded
The NCSC’s guidance after sharing sensitive information distinguishes banking exposure, passwords, workplace devices and possible harmful software. If banking details or money are involved, contact the bank through its trusted route. If a password was shared, secure the affected account and other accounts using the same password through genuine service access.
Tell the relevant support team exactly what happened, including whether you entered information, approved a prompt or installed software. Follow its recovery guidance for the situation. A scan or password change may be one useful step, but do not assume it resolves every possible consequence of the incident.
- Pause and identify the requested action.
- Check whether the context and request make sense.
- Verify through a separate known app, website or contact.
- Avoid sharing credentials or approving uninitiated requests.
- Report suspicious contact through the appropriate channel.
- If you responded, contact the relevant provider and begin recovery promptly.
Our research methodology explains the role of official guidance in these articles. For household planning, keep any confirmed replacement or recovery expense in your monthly budget, while prioritising the provider’s security steps. The immediate objective is to stop further exposure and regain control through trusted channels.
Common questions
Can a well-written message still be phishing?
Yes. Official guidance warns that phishing can look convincing and use familiar branding or personal details. Spelling and design are clues at most, not reliable proof of identity. Focus on the action requested and verify unexpected demands through a separate trusted route before sharing information or making a payment.
What if I really have an account with the named company?
That makes the message plausible, but it does not authenticate it. Open the known app or website independently and check the account there. If clarification is needed, use established support details rather than the link or phone number provided by the message you are trying to verify.
Should I reply to ask whether the request is genuine?
A reply through the same channel can reach the person controlling the suspicious message or account. Use a separate contact method you already trust, especially for changed payment instructions. Ask about the specific action requested rather than treating a reassuring reply in the original thread as independent confirmation.
Are QR codes safer than ordinary links?
No. A QR code can direct you to a destination just as a link can, and it does not establish the sender’s legitimacy. Avoid scanning unexpected codes to test them. Use the service’s known access route and verify the reason for the request before entering information or downloading anything.
Can I share a one-time code with someone claiming to be support?
Do not share passwords or authentication codes in response to an unexpected contact. The code may authorise access or a transaction. Stop and contact the service through its established support route if you are unsure, and do not approve a prompt for an action you did not initiate.
Does multi-factor authentication prevent every phishing attempt?
It adds protection but should not be treated as a guarantee. You still need to check prompts, avoid sharing codes and verify unexpected requests. Review the genuine service’s security options and setup guidance, including passkeys where available, without following unsolicited instructions that ask you to change account access.
What should I do with a suspicious work message?
Follow your organisation’s reporting procedure and tell the support team whether you clicked, entered information or installed anything. Avoid casually forwarding suspicious content to colleagues. A clear, factual report helps the team assess the exposure and provide the appropriate next steps for the account or device involved.
What if I already entered my password?
Use the genuine service to secure the affected account and address other accounts using the same password. Contact the provider or workplace support team as appropriate and explain what happened. Follow the relevant recovery guidance rather than assuming that deleting the original message removes access already obtained by someone else.
What if I provided banking details or sent money?
Contact the bank promptly through a trusted number or app and explain the transaction or information shared. Follow its instructions and the relevant local reporting process. Do not continue communicating with the suspected scammer to negotiate recovery, and keep transaction references and evidence without posting private details publicly.
Do I need to prove a message is malicious before stopping?
No. You can pause an unexpected request and verify it independently without completing a forensic investigation. The goal is to avoid acting on unconfirmed instructions. If the request is genuine, the known service or contact can explain it; if uncertainty remains, seek appropriate support before sharing sensitive information.
