How do I spot a phishing email, text or website?

Warning signs

• Urgency and threat. "Your account will be closed in 24 hours." Real banks do not work to that clock.
• A link that does not match. Hover over it (or long-press on mobile) and read the real destination. Look at the domain immediately before the first single slash — that is the site you will actually land on.
• Lookalike domains. Swapped letters, added hyphens, or an unexpected country suffix.
• Generic greetings, or personal details that are subtly wrong.
• Unexpected attachments — particularly ZIP, HTML or macro-enabled documents.
• A request for credentials. No genuine message will ever ask you to confirm your password or a passcode.

The habit that beats all of this

Never reach your bank through a link. Type the address yourself or use your own bookmark. It costs five seconds and defeats every phishing message ever written.

If you clicked

1. Do not enter anything further. Close the page.
2. If you already entered credentials, change your password immediately from a device you trust and sign out everywhere.
3. Report it — forward the message to us and tell us what you entered.