Phishing red flags: the five patterns scammers reuse
Phishing works because real messages and fake ones look alike. Here are the five patterns that reliably separate them, in order of how often they catch people.
Phishing scams drain real money from real people every day. They succeed not because victims are naive, but because scammers have gotten very good at mimicking the look and tone of legitimate messages. These are the five tells that consistently show up in fraudulent messages — in rough order of frequency.
1. Urgency pressure
"Your account will be suspended in 24 hours." "Verify now or lose access." Legitimate banks almost never create artificial deadlines. If a message is pushing you to act fast, slow down and verify through a separate channel (open the bank app, call the number on the back of your card).
2. Suspicious links or sender address
The displayed text says "ned-som.com" but the actual link points elsewhere. The sender email reads "support@ned-s0m.com" or "nedsom-security.help" — close enough to miss on a phone screen. Always hover over links before clicking (or long-press on mobile to inspect). Legitimate bank domains do not change.
3. Asking for information the bank already has
"Please confirm your full card number and CVV." Your bank already has these. Any message asking you to re-enter them, especially outside the app, is almost certainly a scam.
4. Minor grammar or formatting oddities
Awkward phrasing ("Dear Valued Customer"). Logo at wrong resolution. Date format mismatched to your region. Phone numbers formatted inconsistently. Legitimate corporate communications pass through QA; scams usually do not.
5. Unusual channel
SMS from a short code you do not recognise. WhatsApp message claiming to be your bank (banks almost never use WhatsApp). A phone call from "fraud team" asking you to install an app or move money to a "safe account". These channels are heavily used by scammers specifically because they are hard for banks to officially support.
The one-rule override
If any message asks you to do anything with your account, close it, open your bank app directly, and check from there. If the request was legitimate, you will see it reflected inside the app. If not, nothing was ever asked of you.