How to Spot a Phishing Attempt — Flassword guide

How to Spot a Phishing Attempt

By the Flassword Team · ⏱️ Reading time: 4 min · 🟢 Beginner · Last updated July 16, 2026

No password, however strong, protects you if you type it directly into an attacker's fake login page. Phishing bypasses password strength entirely by tricking you into handing credentials over voluntarily. Here's how to recognize an attempt before that happens.

What phishing actually is

Phishing is a message — email, text, or chat — designed to look like it's from a legitimate service, urging you to click a link and log in, often citing an urgent reason: a security alert, a failed payment, a locked account. The link leads to a fake page that looks nearly identical to the real login screen, and anything you type there goes directly to the attacker instead.

Warning signs in the message itself

  • Urgency and pressure — "act within 24 hours or your account will be suspended" is a classic manufactured-urgency tactic designed to short-circuit careful thinking.
  • Generic greetings like "Dear user" instead of your actual name, especially from a service that would normally address you by name.
  • Slightly off sender addresses — a domain that looks almost right but has an extra letter, a different extension, or an unfamiliar subdomain.
  • Requests for information a legitimate service would never actually ask for over email, such as your full password or a one-time 2FA code.

Before clicking, hover over a link (or long-press on mobile) to preview the actual destination URL without visiting it. Look carefully at the domain — the part immediately before the first single slash after "https://" — since that's the part that can't be faked the way the rest of a URL can be dressed up to look legitimate. A URL like accounts-google-secure.com is not the same domain as google.com, despite superficially referencing the real brand.

What to do if you're not sure

Don't click the link at all. Instead, open a new browser tab and navigate to the service directly by typing its known address, or use an app you already have installed. If there's a genuine issue with your account, it will be visible once you log in through your own trusted path — you don't need to use the link in the suspicious message to find out.

Tip: If you ever do enter a password on a page you later suspect was fake, change that password immediately using our Password Generator, and check whether it was reused anywhere else.

Why even careful people fall for phishing

Modern phishing pages can be pixel-perfect replicas of real login screens, and the psychological pressure built into a well-crafted message is specifically designed to bypass the careful, deliberate thinking that would normally catch a fake. This isn't a matter of intelligence — it's a matter of the message being engineered to trigger a fast, unreflective reaction rather than the slower, more careful evaluation phishing depends on you skipping.

How this connects to your broader password habits

Phishing is precisely why unique passwords per account matter even beyond breach protection: if you're tricked into entering a password on a fake site, the damage is contained to that one account if it was unique, rather than compromising every service where the same password was used. Two-factor authentication adds another layer — many phishing attempts fail at the final step when a second factor the attacker doesn't have is required.

Frequently asked questions

How can I check a link is safe without clicking it?

Hover over it on desktop, or long-press on mobile, to preview the actual destination domain before visiting. Compare that domain carefully against the real service's known, correct domain.

Can two-factor authentication fully stop phishing?

It stops many phishing attempts, since a stolen password alone becomes insufficient. Some more sophisticated phishing techniques can attempt to capture a 2FA code too, but this requires the victim to actively provide it in real time, which is a meaningfully higher bar for the attacker to clear.

What should I do immediately after realizing I entered my password on a phishing site?

Change that password immediately on the real service, and check whether the same password was reused anywhere else — if so, change it there too, since the attacker now has a working credential.

Are phishing emails always poorly written with obvious typos?

Not anymore. While that used to be a reliable tell, modern phishing attempts are often professionally written and visually convincing. Rely on domain-checking and unsolicited urgency as more reliable signals than writing quality.

Is phishing only a risk over email?

No — phishing happens over text messages (sometimes called smishing), phone calls (vishing), and social media direct messages too. The core pattern — urgency plus a request to log in somewhere — is the same regardless of the channel.

Are phishing attempts increasing or decreasing over time?

Broadly increasing, and growing more sophisticated, particularly as attackers use more convincing design and, increasingly, AI-assisted writing to make messages harder to distinguish from legitimate communication.

Should I report phishing attempts I receive?

Yes, where possible — most email providers and platforms have a built-in "report phishing" option, which helps improve their filtering for other users and can help track broader phishing campaigns.

Conclusion

Phishing succeeds by making you act before you think. Slowing down for ten seconds to check a sender address and a link's actual destination stops the overwhelming majority of attempts, and unique passwords plus two-factor authentication limit the damage on the rare occasion one gets through.

Related articles

Free tools for this guide