Phishing is the most common way criminals steal passwords, money and personal information. Instead of breaking into systems, they trick people into handing over the keys. The messages are getting more convincing every year, but they still follow recognisable patterns. This guide shows you how to spot phishing scams, gives real-world examples, and explains exactly what to do if you've already clicked.

What Are Phishing Scams?

Phishing scams are messages that pretend to come from a trusted source — a bank, delivery company, employer, government agency or even a friend — to trick you into:

  • clicking a link to a fake login page,
  • downloading an attachment that contains malware,
  • sharing passwords, card details or one-time codes, or
  • sending money.

Phishing can arrive by email, SMS ("smishing"), WhatsApp and social media messages, or phone calls ("vishing").

Common Types of Phishing Scams

Fake bank alerts

"Your account has been suspended due to suspicious activity. Verify your details within 24 hours." The link leads to a copy of your bank's website that captures your login.

Delivery and parcel messages

"Your package could not be delivered. Pay a small fee to reschedule." These target people who shop online and ask for card details.

Account "security" warnings

Fake messages from Microsoft, Google, Apple, Netflix or social media platforms claim your password must be reset.

Job and investment offers

Unrealistic salaries, "work from home and earn daily", or crypto schemes promising guaranteed returns. Our guide to making money online explains how to spot legitimate opportunities.

Impersonation of friends or bosses

"Hi, it's me, I've changed my number. Can you send money urgently?" or an email that appears to come from your manager asking you to buy gift cards.

One-time code requests

Someone claims to be from your bank or mobile network and asks you to read out a code sent to your phone. That code is often what they need to take over your account.

10 Red Flags of Phishing Scams

  1. Urgency or threats: "Act now or your account will be closed."
  2. Too good to be true: prizes, refunds or jobs you didn't apply for.
  3. Requests for codes, PINs or passwords. Legitimate organisations never ask for these.
  4. Mismatched sender addresses: "support@micr0soft-security.com" instead of the real domain.
  5. Suspicious links: hover over (or long-press) a link to see where it really goes.
  6. Spelling and grammar mistakes — though AI now helps scammers write better.
  7. Generic greetings like "Dear customer".
  8. Unexpected attachments, especially ZIP files, documents that ask you to "enable content", or files ending in .exe.
  9. Payment by unusual methods such as gift cards or crypto.
  10. Pressure to keep it secret or not to contact anyone else.

How to Check If a Message Is Real

  • Don't use the link or number in the message. Open the official app or type the company's website address yourself.
  • Call using the number on the back of your card or on the official website.
  • Verify "new number" messages by calling the person's old number or asking a question only they would know.
  • Check the website address carefully before logging in. Look for small misspellings and extra words.

How to Protect Yourself From Phishing Scams

  • Turn on two-factor authentication so a stolen password isn't enough. See our guide to two-factor authentication.
  • Use a password manager. It only fills in passwords on the genuine website, which helps you notice fake ones.
  • Keep devices updated to block malware delivered through attachments.
  • Filter spam: mark phishing emails as spam or report them to help your provider block similar messages.
  • Educate family members, especially older relatives and teenagers, who are frequent targets.

For more steps, read how to protect your phone from hackers.

Don't panic — act quickly:

  1. Disconnect from the internet if you downloaded a file.
  2. Change your password on the real website from a different, trusted device, and on any account that uses the same password.
  3. Turn on two-factor authentication if it isn't already on.
  4. Contact your bank immediately if you entered card or banking details. Ask them to block the card and watch for fraud.
  5. Run a security scan with your antivirus software.
  6. Check account activity — recent logins, forwarding rules in email, and linked devices.
  7. Report the scam to your bank, email provider and your country's cybercrime or consumer protection agency.

The faster you act, the more likely you are to limit the damage.

Real-World Example: Spotting the Signs

Imagine this SMS: "GTB ALERT: Your BVN has been restricted. Update within 12hrs to avoid account closure: gtb-verify-info.com".

Red flags: urgency (12 hours), a threat (account closure), a web address that isn't the bank's official domain, and a request to "update" sensitive information. The safe response is to delete it and, if worried, contact the bank through its official app or phone number.

Frequently Asked Questions

Can I get hacked just by opening a phishing email?

Usually not. The danger comes from clicking links, downloading attachments or replying with information. Still, don't interact with suspicious messages.

Why do scammers know my name?

Personal details often come from data leaks or public social media profiles. Knowing your name doesn't make a message genuine.

Will my bank ever ask for my PIN or OTP?

No. Genuine banks never ask for your PIN, full password or one-time code by phone, SMS, email or social media.

Is it safe to unsubscribe from spam emails?

For obvious scam emails, don't click "unsubscribe" — it can confirm your address is active. Mark them as spam instead.

Final Thoughts

Phishing scams rely on urgency and trust. Slow down, verify through official channels, and never share codes or passwords. These habits protect you, your money and your family. Explore more safety guides in our Tech section.