How to Detect Phishing: Warning Signs and What to Do

Detecting phishing in time helps prevent security breaches, credential theft and personal data leaks. Phishing is a fraud technique in which an attacker impersonates a company, bank, supplier, public authority or trusted person to make the victim share information, click a link, download a file or approve a payment.

Phishing no longer arrives only by email. It can also appear through SMS, WhatsApp, social media, phone calls, QR codes, fake forms and sponsored ads. That is why it is important to review the whole message, its context and the action requested, not only whether the design looks professional.

Common signs of phishing

• Urgency or fear: messages announcing account blocks, fines, retained deliveries, immediate payments or serious consequences if you do not act within minutes.
• Suspicious sender: domains that imitate the real one, free email addresses, small spelling changes or an address that does not match the organisation.
• Mismatched links: the visible text looks legitimate, but the destination points to another website, an odd domain or a shortened URL.
• Requests for sensitive data: passwords, verification codes, card details, ID numbers, banking data, corporate credentials or customer information.
• Unexpected attachments: invoices, alleged notices, compressed documents or files asking you to enable macros or permissions.
• Unusual tone or context: generic greetings, emotional pressure, poor translations or a request that does not fit the normal relationship.
• Offers that look too good: prizes, refunds, discounts or opportunities that require you to act without verification.

Checklist before clicking

1. Check the real sender domain, not only the visible display name.
2. Hover over the link, or long press on mobile, to see the destination before opening it.
3. Open the website by typing the official address in the browser instead of using the received link.
4. Verify the request through another channel if it involves payments, personal data, credentials or bank account changes.
5. Do not download unexpected attachments and do not enable macros or permissions unless you are certain about the source.
6. Be especially cautious when a message combines urgency, threat and a request for data.
7. In a company, report suspicious messages internally before forwarding or replying.

What to do if you clicked a phishing link

If you only opened the link but did not enter any data, close the page, do not download files and inform the IT team if it is a company device. If you entered credentials, change the password immediately from the official website, review or enable multi-factor authentication and close active sessions.

If you shared banking details or verification codes, contact your bank as soon as possible. If personal data may have been affected in a company, document the incident, preserve evidence and assess whether a data breach notification is required under the GDPR.

Measures for companies

• Train staff with realistic examples and controlled simulations.
• Enable multi-factor authentication for email, critical applications and remote access.
• Configure anti-phishing filters, SPF, DKIM and DMARC for the corporate domain.
• Create a simple internal channel for reporting suspicious emails.
• Limit permissions: not every user should approve payments, access all data or install software.
• Maintain an incident response procedure for credential theft, malware, fraudulent payments and data breaches.

Recommended official sources

• INCIBE: what phishing is.
• INCIBE: how to avoid becoming a phishing victim.
• AEPD: tips to avoid phishing.
• NCSC: defences against phishing attacks.
• CISA: recognize and report phishing.

Conclusion

The best defence against phishing combines human awareness, training and technical controls. Before clicking, replying or downloading a file, pause for a few seconds and verify the sender, the link and the request. In data protection terms, that pause can prevent a breach, a financial loss and reputational harm.