Protect yourself from phishing: five habits before you click

A convincing message can arrive when you are busy, worried, or expecting a delivery. Protecting yourself from phishing means building a routine you can follow even when the message looks familiar.

1. Pause when a message demands action

Treat requests to sign in, pay, open an unexpected file, or share a code as a reason to slow down. Ask what the sender wants you to do and whether you expected that request. A company logo and polished writing do not establish who sent it.

For example, if a delivery message requests a small extra payment, check the order in the retailer’s app or your original order record. Do not use the message itself as the starting point for verification.

2. Take a separate route to the service

Open an app you already use, type a known website address, or call a number from a trusted record. The FTC’s phishing guidance recommends verifying requests through contact information you know is genuine.

At work, verify changed bank details or unusual document requests through your normal process. Replying in the same email thread is not an independent check if that account has been taken over.

3. Strengthen the sign-in behind the message

Use a unique password for each account and enable multifactor authentication where available. Do not approve an unexpected sign-in request or read a verification code to someone who contacted you. Extra sign-in protection helps, but does not make every message safe.

For a practical starting point, follow our account-security checklist. Review the recovery options too, so a lost phone does not leave you guessing.

4. Keep protective tools ready

Allow your supported devices and security software to update, and maintain a backup of important files. The FTC includes updates, multifactor authentication, and backups among its protective measures. Backups help with recovery; they do not prevent someone from misusing information you disclose.

Choose a regular moment to check that these protections are actually working. Our Windows antivirus checkup is one place to begin.

5. Report the message and act on what happened

Use your email service’s phishing-report control or your employer’s reporting process. Avoid forwarding a suspicious attachment to friends for a second opinion.

If you already interacted, write down what you did: opened a page, entered a password, approved access, downloaded a file, or paid money. Those actions call for different responses. Start with our suspicious-link guide and contact the affected provider promptly.

You do not need to prove a message is fraudulent before choosing a safer way to check its claim.