Email phishing
Fraudulent emails may imitate banks, businesses, government agencies, employers or online services to make you click a link, open a file or reveal information.
Tech Learning Hub · Cybersecurity Lesson 03
Phishing, Scam Messages & Social Engineering
Learn how criminals use deceptive emails, messages, calls and fake websites to manipulate people — and how to recognise the warning signs before you respond.
← Cybersecurity lessons
Published: October 27, 2026
Last updated: October 27, 2026
The basic idea
Sometimes the attacker targets the person instead of the computer
Phishing is a form of deception in which an attacker pretends to be a trusted person, organisation or service in order to persuade someone to reveal information, open a malicious file, visit a fake website, send money or give away access to an account.
Social engineering is the broader practice of manipulating people into taking actions that benefit the attacker. Instead of defeating security technology directly, the attacker may try to exploit emotions such as fear, trust, curiosity, urgency or excitement.
These attacks can arrive through email, SMS, messaging apps, social media, phone calls and even face-to-face conversations.
Common channels
A scam can reach you in many different ways
SMS and messaging scams
Scammers may use text messages, WhatsApp or other messaging platforms to send fake delivery alerts, account warnings, job offers or urgent payment requests.
Voice phishing
Fraudulent callers may pretend to represent a bank, company, government agency, technical support team or even someone you know.
Social media scams
Fake profiles, compromised accounts and deceptive advertisements can be used to promote fake investments, giveaways, products or requests for money.
Social engineering
The message may be designed to make you react before you think
A scammer may tell you that your bank account is being closed, a package is waiting, you have won a prize, someone you care about is in trouble or an investment opportunity will disappear within minutes.
The details change, but the objective is often the same: create an emotional reaction strong enough that you act before verifying the request.
Scam message examples
Learn to recognise the pattern
The examples below are educational recreations based on common scam patterns seen internationally. They are not real messages from the organisations or people mentioned.
Fake delivery message
Common internationallyScam example — for educational purposes
“Your package could not be delivered because the address is incomplete. Update your delivery information immediately using the link below.”
What should make you suspicious?
Unexpected delivery notice, urgency and a link asking for personal or payment information.
Fake bank security alert
Banking scam patternScam example — for educational purposes
“ALERT: A suspicious transaction has been detected on your account. Verify your identity immediately to prevent your account from being suspended.”
What should make you suspicious?
Fear and urgency are being used to push you into clicking a link or revealing banking credentials.
Unexpected job offer
Job scam patternScam example — for educational purposes
“Congratulations! You have been selected for a remote job earning excellent daily income. No experience required. Contact us now to begin.”
What should make you suspicious?
Unexpected offer, unusually attractive income and pressure to move quickly without a normal recruitment process.
Friend or relative requesting money
Social media & messagingScam example — for educational purposes
“Hi, I have an emergency and cannot access my bank account. Please send money to this account urgently. I will explain later.”
What should make you suspicious?
The sender may be impersonating someone you know or using a compromised account. Verify through another trusted method.
Fake account suspension
Account takeover scamScam example — for educational purposes
“Your account will be permanently disabled today because of unusual activity. Sign in now to confirm your account.”
What should make you suspicious?
Threat of immediate account loss combined with a sign-in link designed to capture your credentials.
Guaranteed investment return
Investment scam patternScam example — for educational purposes
“Invest today and receive guaranteed profits within 24 hours. Limited spaces available. Send your payment now to secure your position.”
What should make you suspicious?
Guaranteed profits, unrealistic returns, urgency and pressure to transfer money are major warning signs.
Warning signs
Pause when you notice these signals
!
The message creates extreme urgency, fear, excitement or pressure.
!
You are asked to click an unexpected link or open an unexpected attachment.
!
The sender asks for a password, verification code, PIN or other sensitive information.
!
The sender's address, phone number or website domain looks unusual or slightly misspelled.
!
You are told to keep the request secret or avoid contacting the organisation directly.
!
Someone unexpectedly asks for money, gift cards, cryptocurrency or an unusual payment method.
!
An offer promises guaranteed profits, prizes, jobs or rewards that seem unusually generous.
!
A familiar person suddenly asks for money or sensitive information in an unusual way.
Links and websites
Do not trust a link simply because it looks familiar
Scam websites can imitate the colours, logos and layout of genuine services. A link may also use a domain name that looks similar to the real one but contains extra words, different characters or a different domain ending.
When an unexpected message tells you to sign in, make a payment or verify information, it is often safer to avoid the supplied link. Open the organisation's official app or type the known website address yourself instead.
A padlock or HTTPS does not prove that a website is trustworthy.
HTTPS protects the connection between your browser and the website, but scammers can also obtain HTTPS certificates for fraudulent websites. Always check that you are visiting the correct service.
Safe response
What to do when a message looks suspicious
1
Stop and do not act immediately, especially when the message creates urgency.
2
Do not click suspicious links, download unexpected files or call numbers provided in the suspicious message.
3
Verify the request independently using an official website, trusted app or phone number you already know.
4
Check the sender address and website domain carefully before entering any information.
5
Never provide passwords, PINs or one-time verification codes because someone requested them unexpectedly.
6
If the message appears to come from someone you know, contact that person through another trusted method.
7
Report suspicious messages using the reporting tools provided by your email, messaging service, bank or relevant authority.
8
Delete the message after reporting it when appropriate.
If you already clicked
Act quickly, but do not panic
Clicking a suspicious link does not automatically mean every account or device has been compromised. What matters next depends on what happened — for example, whether you entered credentials, provided financial information or downloaded a file.
1
Stop entering information and close the suspicious page.
2
If you entered a password, change it immediately from the legitimate service and change any other account using the same password.
3
Enable or review multi-factor authentication on the affected account.
4
If financial information was exposed, contact your bank or payment provider using an official contact method.
5
Review the account for unfamiliar logins, transactions, messages or security-setting changes.
6
Run appropriate security checks on the device if you downloaded or opened a suspicious file.
7
Keep evidence such as screenshots or transaction details if you need to report the incident.
Trusted resources
See real-world guidance from recognised organisations
Scam techniques change over time. These external resources provide additional guidance and examples from cybersecurity, consumer protection and law-enforcement organisations.
U.S. Federal Trade Commission — Consumer Advice
Consumer guidance about scams, phishing, impersonation fraud and reporting suspicious activity.
CISA — Secure Our World
Cybersecurity guidance from the U.S. Cybersecurity and Infrastructure Security Agency.
INTERPOL — Social Engineering Scams
International information about social engineering techniques and financial fraud.
UK National Cyber Security Centre — Phishing
Practical guidance for recognising and responding to phishing and suspicious messages.
External websites are provided for educational reference. Their content and availability are controlled by the respective organisations.
Key takeaways
What to remember
✓
Phishing attacks target people as well as technology.
✓
Urgency, fear, curiosity and attractive offers are commonly used to influence decisions.
✓
A familiar logo, name or profile picture does not prove that a message is genuine.
✓
Never provide passwords or verification codes because of an unexpected message or call.
✓
Verify suspicious requests independently instead of using the contact information supplied by the suspicious sender.
✓
If you make a mistake, responding quickly can help reduce the damage.
Next lesson
Malware, Ransomware & Dangerous Downloads
Next, we will examine malicious software, how dangerous downloads can reach computers and mobile devices, how ransomware works and the practical steps that can reduce your risk.