What Phishing Looks Like
Phishing is a message, call or website that pretends to be a trusted company in order to collect your passwords, OTPs or payment details. It can arrive by SMS, email, chat apps, social media or even a paid search result.
Common Warning Signs
| Warning sign | Illustrative wording | Why it is suspicious |
|---|---|---|
| Artificial urgency | “Your account will be closed in 30 minutes” | Real platforms rarely demand action within minutes. |
| Request for a code | “Reply with the OTP we sent you” | An OTP exists to prove you are the one signing in. Nobody legitimate needs it from you. |
| Unexpected prize | “You have won a free bonus, click to claim” | Scammers use rewards to rush you. |
| Different web address | A domain that adds extra words or swaps letters | Copies of a brand name often differ by one character. |
| Payment to a personal account | “Send a fee to release your winnings” | A genuine prize does not require an advance fee. |
The wording above is illustrative, not taken from any real message.
How to Check a Message in Under a Minute
- Step 1
Pause
Scammers depend on speed. Do not tap anything yet.
- Step 2
Look at the sender
Check the number or email address, not just the display name. Compare it with the official contact details.
- Step 3
Inspect the link without opening it
On a computer, hover the mouse over the link. On a phone, press and hold to preview the address. Look for misspellings or unusual endings.
- Step 4
Go to the site yourself
Open your browser and type the official address, or use a saved bookmark. If there is a real problem, it will be visible in your account.
- Step 5
Ask official support
Use the contact channel listed on the official site, not the one in the message.
If You Already Clicked or Entered Details
- Change your password on the real site at once, then on any other site that used the same one.
- Contact your bank or e-wallet provider if you entered payment details, and ask them to block or monitor the account.
- Turn on two-factor verification, if available.
- Run a security scan on your device.
- Keep screenshots of the message and the web address.
Where to Report
Report the message to the platform it impersonates. In the Philippines you can also report cybercrime to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division, and report the sender to your mobile network or messaging app.
Conclusion
Any message that asks for a password, a code or money should be treated as a scam until you verify it another way. For more steps to take on your own account, see our password guide and the login guide.
Frequently asked questions
Can phishing messages look completely genuine?
Yes. Logos and tone can be copied well. That is why you should verify the address and avoid acting from the message itself.
Will a real platform ever ask for my password?
No. Genuine support never needs your password or OTP.
Is a link safe if it starts with https?
Not necessarily. Many fake websites also use https. What matters is whether the domain name is the real one.
