How phishing works and how to report it

Phishing does not try to break into anything technically. It asks, directly and politely, to be let in — by convincingly imitating something the target already trusts, closely enough that handing over a password or clicking a link feels routine rather than risky. Understanding the mechanics of that trick is what makes it recognisable, because it relies on the same small number of techniques every time.

The mechanism, not just the message

A phishing attempt has three components working together. First, a pretext: an email, text message or notification that looks like it comes from a bank, a supplier, a colleague, or a service you actually use. Second, urgency: a reason to act immediately rather than pause and verify — a suspended account, an unpaid invoice, a security alert, a missed delivery. Third, a destination: a link to a page built to look identical to the real login or payment page it is imitating, which quietly captures whatever is typed into it.

The urgency component is doing most of the work. A calm, unhurried reader is far more likely to notice something is off; a reader who believes they have thirty minutes to avoid their account being suspended is not reading carefully at all, which is precisely the intended effect.

Why a convincing copy is easy to make

Copying the visual design of a real login page is trivial — the HTML, styling and images of any public page can simply be saved and reused. What actually distinguishes a phishing page from the real one is almost never the appearance; it is the address it is hosted at, the certificate behind it, and where the submitted data actually goes. That is also why a page having a valid padlock proves nothing about whether it is genuine — a domain-validated certificate confirms only that whoever registered that domain controls it, and anyone can register a domain, including one deliberately named to resemble a trusted brand.

Common signs worth checking specifically

• The domain is close but not exact — an extra word, a swapped letter, a different top-level extension than the real organisation actually uses.
• The link text does not match where it actually leads — hovering over a link (without clicking) on most email clients shows the real destination, which is worth checking whenever the displayed text and the destination might differ.
• Urgency paired with a request for credentials or payment — a genuine security alert from a real service essentially never asks you to log in through a link in the message itself; it points you to visit the service directly instead.
• A request that does not fit the relationship — a supplier asking for payment to a new bank account by email alone, or a colleague asking for credentials they would not normally need, is worth verifying through a separate channel before acting.

If your own domain is being impersonated

Two distinct situations get confused with each other here, and they need different responses.

If someone has actually compromised your website and placed a phishing page on it, that is a genuine security incident on your side, and the response is the same as for any other compromise: follow what to do first if your website is hacked, remove the malicious content, change every credential, and find and close whatever allowed it in.

If instead someone is sending emails with a forged "From" address that merely looks like it comes from your domain, your site itself may not be compromised at all — the plain text "From" header in an email is not verified by the email protocol itself unless specific DNS records are in place to check it. SPF, DKIM and DMARC explained covers the records that let receiving mail servers actually verify a message claiming to be from your domain really is.

Reporting it

If you have received a phishing attempt, most email providers and browsers have a built-in reporting option — using it helps the underlying blocklists used across the industry improve, beyond just protecting you individually. If a website is impersonating a specific organisation, that organisation's own site typically has a dedicated abuse or security contact for exactly this. If phishing content is hosted on infrastructure you believe should not be allowing it, reporting it through the relevant provider's abuse channel is the appropriate route rather than attempting to contact the page directly.

The most reliable habit

Beyond recognising the signs above, the single most effective habit is refusing to act from inside the message itself. Instead of clicking the link in an email claiming your account needs attention, open a new browser tab and go to the service directly, the way you normally would. If there genuinely is a problem with your account, it will be visible once you are logged in through your own trusted route — and if the message was fake, you have avoided it entirely without needing to have spotted a single one of the warning signs above.