Phishing is one of the most common online scams. It happens when criminals pretend to be a trusted company, bank, courier, government department, supplier, or even someone you know.

The goal is usually to get you to do one of these things:
• Click a link.
• Open an attachment.
• Enter your password.
• Share an OTP.
• Update banking details.
• Pay a fake invoice.
• Install remote-access software.

Phishing is not always obvious

Many people think phishing emails are easy to spot because they contain bad spelling or strange wording. Some do. But modern scam messages can look professional. Some are written using AI tools. Some copy real company branding. Some even arrive inside a real email conversation after a mailbox has been compromised.
That is why the safest approach is to check the request, not just the design.

Common phishing examples

You may see messages such as:
• “Your email account will be suspended unless you verify your mailbox.”
• “Your package is waiting. Pay a small delivery fee.”
• “Your SARS refund is under review. Click here.”
• “Your account has suspicious activity.”
• “Your invoice is attached.”
• “Your subscription has renewed. Call this number to cancel.”
• “Your bank card has been blocked.”

These messages often use fear, urgency, curiosity, or money.
SMS and WhatsApp scams
Phishing is not only email. SMS phishing is called smishing. Voice-call phishing is often called vishing. WhatsApp scams are also common because people trust messages that look personal.

A scammer may pretend to be:
• A family member with a new number.
• A bank employee.
• A courier company.
• SARS.
• A buyer or seller on a marketplace.
• A company support agent.
• A friend inviting you to invest.

How to protect yourself
Use these habits:
1. Do not click links in unexpected messages.
2. Do not enter passwords after clicking email or SMS links.
3. Do not share OTPs or MFA codes.
4. Do not trust caller ID or display names.
5. Verify requests using official apps, websites, or known numbers.
6. Report suspicious messages.
7. Delete messages once reported or confirmed fake.

What if you clicked?

If you clicked a link but did not enter anything, close the page and be cautious. If you entered a password, change it immediately from the official website or app. If you shared banking or card details, contact your bank urgently. If you installed software, disconnect the device from the internet and get help.

This week’s action: Pick one important account, such as email or banking, and make sure it has multi-factor authentication enabled.