Spotting phishing

In the address example.com.account-check.example, the site that actually owns the page is account-check.example; the example.com at the front is only a label its owner chose.

A parcel text the courier never sent

Here is a made-up text of a familiar kind: "Your parcel could not be delivered because the address is incomplete. Update it within 24 hours", followed by a short link. If you are waiting for a delivery, your thumb is already on the link. That is phishing: a message designed to make you open a harmful attachment, click a link to a fake site, or hand over personal or financial details. It arrives by email, by text message (often called smishing), by messaging app and by phone.

The signs in that one short text

CISA lists the common signs, and the parcel text has most of them. Urgent or emotional language, with a threat of trouble if you do not act now. A request for personal or financial information. An untrusted shortened link. A sender address or link that is slightly wrong, with a letter swapped or an extra word added. One old sign no longer works, though. Phishing used to be easy to spot by its poor spelling and grammar, but CISA notes that in the age of AI some messages now have perfect grammar and spelling. So look at what the message wants you to do, not at how well it is written. A bank account "locked for your safety", a prize you never entered for, a family member with a new number who needs money today: each pushes you to act before you think.

Reading a link from the right

Before you tap a link, look at the host name: the part after https:// and before the first single slash. Read it from the right. The last two parts (or three, for addresses like .co.kr) name the organisation that controls it, and everything to their left is a label that organisation chose. So login.example.com belongs to example.com, but example.com.account-check.example belongs to account-check.example. On a phone, press and hold a link to see the full address without opening it. Passkeys help here too, because they simply will not work on a site that is not the real one. (All the addresses on this page use names reserved for examples, such as example.com and the ending .example, so none of them is a real site.)

Check through another route, then report

CISA gives three tips: recognise, resist and delete, and the signs above are the first. Resist means you do not click links or open attachments in a message you are unsure of, and you do not reply, not even to an "unsubscribe" link. If the message claims to be from a company you use, open its app or type its address yourself and check there. If it claims to be from someone you know, call them on the number you already have. Then delete the message, after reporting it with the "report spam" or "report phishing" option in your email or messaging app. In Korea, KISA runs a free line, 118, for hacking, spam and personal information problems; its menu also connects voice phishing and smishing reports to the police. KISA's Boho Nara site (boho.or.kr) offers a service for checking suspicious text messages.

Phone calls follow the same pattern. A caller says they are from your bank, a delivery company, the police or a prosecutor's office, tells you your account is involved in a crime and asks you to move money, install an app or read out a code. Real institutions do not ask for that over the phone. Hang up, look up the official number yourself and call back. Never install an app or a remote-control program because a caller told you to.