How to Spot Phishing Messages and What to Do After Clicking

Technology9 min read

An apparently ordinary message about a parcel, a declined payment, an invoice or a blocked account may be a phishing attempt. The goal is simple: someone is trying to get you to provide passwords, card details, confirmation codes or access to your accounts.

The rule that offers the best protection is this: do not click the link, open the attachment, disclose codes received by SMS, or act under pressure. Verify the request through a separate channel, using the official website, official app or a phone number you already know.

What is phishing, in brief?

Phishing is a form of online fraud in which criminals pose as a trusted organisation, company or person. They may copy a bank’s logo, a courier’s tone of voice, the name of a public institution or a friend’s photograph.

The message usually seeks one of the following actions:

to get you to visit a fake website and enter your login details;
to get you to disclose your card number, expiry date or security code;
to get you to pass on a one-time code received by SMS or in an authentication app;
to get you to install an app or remote-control software;
to get you to make a transfer “to secure your money”.

The attack may arrive by email, SMS, WhatsApp, Facebook, a QR code displayed in a public place or by phone. Phishing by SMS is often called smishing, while phishing by phone call is known as vishing.

Warning signs that should stop you immediately

A single clue does not always prove fraud, but several signs together warrant careful verification. In practice, pressure to act quickly is one of the most important warning signs.

Warning sign	What it may mean	What to do
“Act now”, “your account will be blocked”, “you have 10 minutes”	The message is trying to rush you before you can verify it.	Stop. Do not follow the instructions in the message.
An unusual or shortened link	It may lead to a page that imitates the real site.	Open the app manually or type the official address into your browser.
A sender with a familiar name but a strange address	The displayed name may be spoofed; the actual address matters.	Check the domain after the @ sign and the letters in the address.
A request for a password, PIN, SMS code or card details	The data may be used to access your account or authorise payments.	Do not reply or provide anything.
An unexpected attachment	It may contain malware.	Do not open it; confirm with the sender separately.
Language errors, odd wording or careless design	These may indicate a fake message, but the absence of errors does not guarantee authenticity.	Verify the sender’s identity independently.
An offer that is too good to be true	It may be an attempt to obtain money or personal data.	Compare the offer and look up the retailer through independent channels.

How to check a suspicious message correctly, step by step

Do not use the link, phone number or button in the message. Even if the message appears to come from a bank, courier or a familiar platform, these may be controlled by fraudsters.
Open the official app yourself. If the SMS claims there is a problem with a bank account, go directly to the bank’s app. If it concerns a parcel, check the delivery through your account on the courier’s website.
Use a known contact channel. Call the number on the back of your card, on your contract or on the official website. Do not call the number provided in the message you received.
Look carefully at the website address. One changed letter, a number instead of a letter or an unusual domain can be enough to take a user to a fake page.
Verify the request, not just its appearance. A convincing logo and a padlock in the browser do not prove that a page is legitimate. An HTTPS connection protects communication with the website you access, but does not guarantee that the owner of that site is who they claim to be.
Ask yourself whether the request is normal. For example, a reputable institution should not ask you by message for your online banking password, card PIN or an authorisation code to “cancel a fraud”.

Common traps: the parcel, the bank, the blocked account and the “approved loan”

The parcel SMS

The message may say that the package cannot be delivered until you pay a small fee. The low amount is used to get you to enter your card details quickly. Check delivery only in the courier’s app or on its website, which you access yourself.

The message about a blocked bank account

Fraudsters rely on fear: “account suspended”, “suspicious transaction”, “confirm urgently”. Do not use the link you received. Open your banking app or contact the bank on its official number.

The call about a loan you did not apply for

In this scenario, the caller claims to be an employee of a bank, the police or an authority, and tells you that you must urgently cancel a loan or move money to a “safe account”. The number displayed on your phone may appear genuine, because caller identification can be spoofed.

For more information about passwords, you can also read Passkeys in 2026: how to replace passwords without getting locked out of your accounts, which provides additional details on this subject.

End the call and call the institution yourself. Do not confirm personal data, install apps at the caller’s request or transfer money to “protect” your account.

The QR code stuck over a poster or sent in a chat

A QR code can hide a link just as easily as an SMS can. After scanning it, read the address that appears before opening it. If you are asked to log in or pay, search directly for the relevant service in your browser or the official app.

Practical example: how to analyse a suspicious SMS

Suppose you receive the following message: “Bank: we detected an unusual payment. Confirm within 15 minutes here: exemplu-verificare-cont.ro”.

The urgency is unusual and reduces the time you have to think.
The link should not be opened to check it.
The displayed name is not sufficient confirmation that the message was sent by the bank.
The correct action is to open the bank’s app or call the number on the card. If the payment does not appear there, do nothing further through the link in the SMS.

What to do if you clicked a phishing link

Simply clicking does not automatically mean you have lost money, but it is a good idea to act methodically. The seriousness of the situation depends on what you did after opening the page.

If you opened the link but did not enter any data

Close the page without filling in forms or downloading files.
Do not accept notifications, permissions or the installation of an app.
Update your device’s operating system, browser and security solution.
Run a security check if the page downloaded a file or if you notice unusual behaviour on your phone or computer.

If you entered an account password

Change the password immediately, ideally from a device you have reason to believe is secure.
Use a new, long and unique password; do not reuse the password used for email, social media or other services.
End active sessions in the account settings, if the service offers this option.
Enable two-step authentication, preferably through an authentication app or security key, where available.
Check the recovery address, linked phone number and any email forwarding rules.

If you provided banking details, SMS codes or made a transfer

Contact your bank immediately, using its official number, to block the card, access or unauthorised transactions. Time matters.
State exactly what you disclosed: card details, login credentials, a confirmation code, personal data or the transfer details.
Check your transaction history and enable alerts for banking activity if you did not already have them.
Keep screenshots, the caller’s number, messages, website addresses and proof of payment. Do not delete the conversation before saving this information.
Report the incident to the Police. For support and to report cybersecurity incidents, you can contact the National Cyber Security Directorate at 1911 or alerts@dnsc.ro.

Do not install remote-control apps at a caller’s request

One dangerous type of fraud begins with a call telling you that there is a problem with your phone, bank account or computer. You are then asked to install a remote-access app.

Once you grant access, someone else may be able to see your screen, track what you type or guide you into authorising transactions. Do not install anything or share your screen at the request of someone who contacted you unexpectedly. If you have already done so, disconnect the device from the internet, contact your bank if you opened the banking app and seek technical help to have the device checked.

Simple habits that reduce risk

Use different passwords for email, banking, online shopping and social media.
Enable two-step authentication for email and important accounts. Email is essential because it can be used to reset passwords for other services.
Keep your phone, computer, browser and apps updated.
Install apps only from official stores and check the developer carefully.
Set up payment notifications and, if your bank allows it, suitable limits for transfers or online payments.
Do not needlessly publish personal data, photos of documents, plane tickets, cards or information that may help someone impersonate you.
Discuss these rules with parents, grandparents and teenagers in your family. Fraudulent messages are designed precisely to appear credible in moments of haste or emotion.

A 30-second checklist before you reply

Am I being asked to hurry?
Am I being asked for a password, SMS code, PIN or card details?
Am I being asked to open a link, scan a QR code or install something?
Can I verify the situation directly in the official app or through a known phone number?
Does the request make sense for that service?

If the answer to any of the first three questions is “yes”, treat the communication as suspicious until it has been verified. Taking a few minutes to pause is often the most effective protective measure.

Frequently asked questions

What is phishing?

Phishing is a scam in which someone impersonates a bank, courier, institution or person you know to obtain passwords, banking details, confirmation codes or other sensitive information.

Is it dangerous if I clicked a link but did not fill in anything?

The risk is generally lower than if you entered data or downloaded a file, but close the page, do not grant permissions, do not install apps and update your device. Run a security check if you downloaded anything or notice unusual behaviour.

Can a call displaying the bank’s number be fake?

Yes. In spoofing attacks, criminals can falsify the information displayed as the caller’s number. End the conversation and call the official number on the back of your card or on the bank’s website yourself.

Will my bank ever ask for my password, PIN or SMS code by phone?

You should not provide such details following an unexpected call, SMS or email. If someone requests them, end the conversation and verify independently with the bank.

What should I do if I gave my card details on a fake website?

Contact your bank immediately on an official number to block the card and limit unauthorised transactions. Save the evidence, check the activity in your account and report the incident to the Police and DNSC.