Phishing: spot the trap and react without panicking

On a Monday morning, you receive an email from your delivery service. The parcel cannot be delivered, 1.95 euros is missing and the message invites you to "settle now". You really are expecting a parcel. The logo is correct, the sentence well written and the amount small enough not to worry you.

That is precisely what makes phishing effective. It does not always try to tell an extraordinary story. It looks for the right moment when an ordinary message coincides with your life.

Recognising an attempt is therefore no longer about hunting for spelling mistakes. You need to look at the situation, the action being requested and how you can verify it.

The setting changes, the goal stays the same

A phishing message usually wants one of these things:

• your password or a login code;
• your bank details or an itsme approval;
• for you to open a file or install software;
• a payment;
• personal information that can be used for later fraud.

The parcel, the fine, the tax refund, the suspended account and the invoice are just pretexts. This way of reading is useful because it works even against a scenario you have never seen before.

When you read a message, ask yourself: "If I follow the instructions exactly, what does the sender get?"

First signal: your thinking time is being cut short

"Final reminder", "account blocked tonight", "payment to approve immediately". Artificial urgency does not prove fraud on its own, but it should change your behaviour: the more a message rushes you, the more you should slow down.

Fraudsters sometimes add a second pressure: confidentiality. A fake executive asks you not to tell anyone about a sensitive transaction. A fake bank adviser claims the investigation will fail if you contact your branch. This demand for isolation is a particularly strong signal.

A legitimate organisation accepts that you close the message and come back through its official channel.

The display name is not the address

Your email app may display "Bank", "Management" or a relative's first name while the real address is completely different. On a computer, open the sender details. On a phone, tap the name to see the full address.

Look at the part after the `@`. The most deceptive variants add a word, replace a letter or use a different extension. An address such as `service@bank-verification.example` may seem plausible because it contains the expected name; the real domain is still what comes immediately before the extension.

Be careful, though: a correct address does not guarantee a genuine message. A mailbox can be compromised. That is why you also need to examine the request.

A link can say one thing and open another

The visible text of a button proves nothing. On a computer, hover over it without clicking. On a phone, a long press often reveals the destination.

Very long addresses, URL shorteners and redirect pages make it hard to read. Do not try to become an expert in every URL. If the message is about an existing account, the safest method is simpler: do not follow the link. Open the usual app or type the address you know yourself.

If the alert is real, it will usually appear in your account.

An unusual request matters more than a typo

Ask yourself a few concrete questions:

• is it normal for this organisation to ask me for a code by email?
• have I already paid this supplier into this bank account?
• why does someone calling me need me to approve a transaction?
• why do I need to install a remote access tool?
• why is this colleague suddenly changing channel and tone?

A bank does not ask for your personal codes. A serious IT department does not ask for your password. A public body does not require you to transfer money to a "safe" account.

Modern phishing spans several channels

The email may only be the beginning. After a click, someone calls and claims to be helping you. Fake support continues the conversation on WhatsApp. A QR code leads to a mobile page where the address is less visible.

Each new channel seems to confirm the previous one, when they are all controlled by the same team. That is why "calling the number in the message" is not independent verification.

To verify, use a number you have already saved, the one on your bank card, an old invoice or the official website found separately.

What if the message really does come from a colleague?

A compromised work mailbox allows the fraudster to read conversations and step in at the right moment. They can copy a signature, quote a real invoice and reply within the existing thread.

Financial requests must therefore follow a procedure that is independent of email. A change of bank details is confirmed by phone with a known contact. An unusual payment gets a second approval. The rule protects against hacking as much as against internal error.

One-time codes do not make a fake site safe

Some phishing pages pass your username and password to the real service in real time. They then ask you for the code you received and replay it immediately. Authentication by app or SMS is still useful, but it does not stop every attack.

Passkeys and physical security keys offer better resistance: they check the website's domain. On an imitation, they will normally refuse to authenticate.

Enable them first on your email, your password manager and your administrator accounts.

You clicked: what now?

A click does not always have the same consequences. Don't panic; work out what happened.

### You only opened the page

Close it. Do not download anything or fill in any field. Forward the message to `suspect@safeonweb.be`. If the browser or device behaves strangely, ask for it to be checked.

### You entered a password

From a clean device, change the password for the account concerned. If it was reused, change it everywhere. Revoke active sessions, check the recovery address and inspect your mailbox's forwarding rules.

### You gave out a code or approved itsme

Contact the organisation concerned immediately using an official number. If it involves a bank transaction, call your bank without delay. Do not just change a password: the transaction may already have been authorised.

### You opened a file or installed a program

Disconnect the device from the network without wiping the evidence. Contact your support team or a professional. In an organisation, report the incident immediately; time wasted hiding a mistake only helps the attacker.

A culture where reporting is not confessing

Awareness campaigns often repeat "don't click". That advice is not enough. Messages are designed to provoke the click, and a person in a hurry will eventually make a mistake.

A resilient organisation makes it clear:

• where to forward a dubious message;
• who to call after a mistake;
• that prompt reporting will not be punished;
• which transactions require a second approval.

The first colleague to report a campaign can protect the whole team. Silence, on the other hand, turns an individual mistake into a collective incident.

Official resources

• Safeonweb — advice on phishing
• CCB — Belgium's cyber reality in 2025 (FR)
• Report suspicious messages: `suspect@safeonweb.be`