Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Phishing is a deception designed to make you act before you verify. The message may impersonate a bank, delivery company, employer, government service, friend, or online account and push you toward a link, attachment, phone number, payment, or password request. An urgent threat, an unexpected refund or prize, a fake invoice, a delivery problem, or a request for identity information are common patterns. A convincing logo, familiar display name, polished layout, or perfect grammar does not prove that the sender or website is genuine.
The safest habit is to stop, avoid the message’s links and contact details, and verify through a website address, phone number, or app you already know. If you already clicked, the right recovery steps depend on whether you only opened a page, entered a password, downloaded a file, or exposed financial or identity information.
What phishing is—and why it works
Phishing messages impersonate a trusted person or organization to steal passwords, account numbers, payment details, Social Security numbers, or other information. The Federal Trade Commission says, “Scammers use email or text messages to try to steal your passwords, account numbers, or Social Security numbers.” Attackers rely on a short decision window: a warning says your account will be closed, a parcel cannot be delivered, a payment failed, or a reward will expire unless you act immediately.
In a 2025 consumer alert, the FTC reported that email was the top method scammers used to contact people in 2024. That does not mean every unexpected email is fraudulent, but it makes unsolicited requests worth checking independently rather than answering on the message’s terms.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Phishing can arrive by email (often called phishing), text message (smishing), social-media message, workplace chat, or a copied website. The channel changes; the underlying test is the same: does the communication try to make you trust an identity and take a sensitive action before you have verified the source?
How to recognize a phishing email
1. Check the sender address, not just the display name
Email apps prominently show a name such as “Your Bank” or “Payroll,” but the visible name is easy to fake. Open the message details and inspect the complete address. Compare the domain after the @ sign with the organization’s known domain, including spelling, punctuation, and the ending. A look-alike domain, an added word, a swapped letter, or an unrelated free-mail address is a warning sign.
Even a matching-looking address is not conclusive: compromised accounts and forged headers exist. Treat the address as one clue, then verify through a known-good channel.
2. Notice pressure, threats, and unusual requests
Be especially cautious when a message demands immediate action, threatens suspension or legal consequences, asks you to “fix” a payment, or requests a password, one-time code, bank detail, tax identifier, or gift-card purchase. A legitimate service may contact you about an account, but you can normally check the issue by opening its app or typing its address yourself rather than using the message’s button.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Inspect the real link destination
On a computer, hover over a link without clicking. Your browser or mail program should show the destination. Read the complete domain, not merely the words in the message. Text that says “Sign in to your bank” can lead somewhere unrelated, and a long address can hide the important domain in the middle or at the end.
On a phone, press and hold a link to preview its destination when your mail or messaging app supports that feature. Do not rely on a preview alone; independent navigation is safer. A link that uses a shortened address, an unexpected country-code domain, or a misspelled organization name deserves no click.
4. Treat unexpected attachments as dangerous
Invoices, shipping forms, shared documents, and voicemail files can be used to install malware or open a credential-stealing page. Do not open an attachment simply because the file name or icon looks familiar. If you expected a document, confirm with the sender using a contact method you already had before the message arrived.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match5. Ask whether the message fits your real activity
Did you order a package, request a refund, open a support case, or start a sign-in? An unexpected message is not automatically fake, but a mismatch between the claim and your activity increases the risk. Watch for unusual greetings, unexplained changes in payment instructions, requests to move a conversation to another channel, or a tone that differs from the supposed sender.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Signal | Why it matters | Safer response |
|---|---|---|
| Urgent threat or deadline | Pressure discourages checking and encourages impulsive clicks. | Close the message and inspect the account through its normal app or typed address. |
| Sender name looks familiar | Display names and logos are easy to spoof. | Open the full address and compare the domain character by character. |
| Link to sign in or pay | The destination may capture credentials or card data. | Do not click; navigate independently. |
| Unexpected attachment | It may install malware or lead to a fake sign-in page. | Confirm the file through a known contact before opening. |
| Request for password or financial data | Phishers target information that can unlock accounts or money. | Refuse the request in the message and contact the organization directly. |
How to recognize a phishing text message (smishing)
Smishing uses SMS or another messaging service to create the same false urgency in a smaller format. FTC examples include fake package-delivery notices, invoices, suspicious-activity alerts, payment-problem messages, free-prize or coupon offers, and requests for account or identity information. A short message can still lead to a full spoofed website that records a username and password.
Do not reply to a suspicious text, click its link, call its number, or use an “unsubscribe” link. Replying confirms that your number is active and can invite more messages. Instead, use your carrier’s built-in spam-reporting option or forward the message to 7726 (SPAM) where that service is supported. Take a screenshot first if you may need the details for a workplace, bank, carrier, or law-enforcement report.
Check delivery claims, account alerts, and payment notices in the organization’s official app or by typing its known address. A real parcel can be tracked from the retailer or carrier account you already use; a real card alert can be checked by calling the number printed on the card.
Recommended Free Tools
How to tell whether a website is fake
Use independent navigation
The strongest practical test is how you reached the site. Do not sign in from a link in an unexpected message. Open a new browser window, use a bookmark you created earlier, or type the organization’s known address yourself. For a bank, card issuer, employer, or government service, use an address from a statement, card, official letter, or previously verified contact.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the message claims to be from a service you use, open that service through your normal app or browser bookmark and look for the same alert there. If the issue does not appear in the genuine account, treat the message as fraudulent.
Read the address bar carefully
Look for the organization’s actual domain and beware of extra words, misspellings, substituted characters, and unfamiliar subdomains. Attackers can register addresses that look close enough at a glance. A padlock or an address beginning with HTTPS only means that the connection is encrypted; it does not prove that the site is operated by the claimed bank, retailer, or government agency.
Do not trust copied design
A fake site can reproduce a logo, colors, login form, privacy text, and even a customer-service chat window. Visual quality is not authentication. Be suspicious if the page asks for more information than the genuine service normally needs, requests a one-time code immediately after a password, or sends you through several unexpected redirects.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect account credentials
Google advises that if a link asks for a Google password, go directly to the service instead of entering it on the linked page. The same rule applies to every account. Never type a password or authentication code into a page reached from an unverified message.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A safe response when a message arrives
- Stop. Do not click, reply, call the number in the message, download an attachment, or enter credentials.
- Record the basic details. Note the sender, subject or wording, time, phone number, visible link, and any attachment name. Do not forward the message widely.
- Verify independently. Open the organization’s known app or type its known address. Alternatively, call a number from a bill, payment card, or official website—not a number supplied in the suspicious message.
- Check for a real account event. Look for the claimed transaction, delivery, security alert, or support case after signing in through the genuine service.
- Report it. Report suspicious email to your provider and to the Anti-Phishing Working Group at reportphishing@apwg.org. Report suspicious texts through your carrier or 7726. You can report scams to the FTC at ReportFraud.ftc.gov. Follow your employer’s or school’s reporting procedure if the message used a work or education account.
- Delete it after reporting. Removing the message reduces the chance that you or someone else will click it later. Empty the trash only after any required reporting or evidence-preservation step.
What to do if you clicked a phishing link
Clicking a link does not always mean an account was compromised, but treat the event seriously. The risk depends on what happened next.
If you opened the page but entered nothing
- Close the tab and do not download anything it offered.
- Update the operating system, browser, and security software on the device.
- Run a security scan and remove anything it identifies.
- Watch the account that the message impersonated for unfamiliar sign-ins, password-reset notices, or transactions.
If you entered a password or one-time code
- From the organization’s genuine website or app, change the exposed password immediately.
- Change that password anywhere else you reused it. Start with email, because access to email can enable resets for other accounts.
- Enable multi-factor authentication (MFA) and review active sessions, recovery addresses, forwarding rules, and trusted devices.
- Contact the service’s official support or fraud team if the attacker may have changed account details or used the code.
If you downloaded or opened a file
- Disconnect the device from networks if you see suspicious behavior, such as unknown pop-ups, new programs, disabled security tools, or unusual account activity.
- Run updated security software and remove anything it identifies.
- Install operating-system and application updates, then change credentials from a separate, trusted device if malware is suspected.
- Tell your workplace or school security team promptly if the device or account is managed by them.
If financial or identity information was exposed
Contact the bank or card issuer through its official fraud process and monitor transactions. If Social Security information or other identity data was exposed, use the official guidance at IdentityTheft.gov and follow the affected institution’s instructions. Record what you entered, when you entered it, and which accounts or devices were involved while the details are fresh. Prompt reporting can limit further misuse.
Defenses that reduce phishing damage
Use MFA, preferably a phishing-resistant method
The FTC describes MFA as requiring two or more credentials. The factors can be something you know, such as a password or PIN; something you have, such as a one-time code, authenticator app, or security key; or something you are, such as a biometric. MFA can stop an attacker who has only your password, although codes can still be tricked out of you on a convincing fake page.
A FIDO2 security key provides a physical, phishing-resistant sign-in method for compatible accounts. Before buying one, verify that the key works with your phone, computer, browser, and the accounts you need, and set up a recovery method. Keep a spare key or another supported recovery option in a safe place so losing the key does not lock you out.
Use a password manager and unique passwords
A password manager can generate a different password for each account and usually will not autofill a password on a look-alike domain. That behavior gives you a useful warning. Protect the manager itself with a strong, unique password and MFA, and understand its account-recovery process before you need it.
Compare defense options by your situation
| Defense | Protection against stolen passwords | Phone and desktop convenience | Recovery considerations | Scope |
|---|---|---|---|---|
| SMS one-time code | Helps when only the password is stolen, but codes can be intercepted or relayed through a fake site. | Works on most phones and computers. | Depends on access to the phone number and carrier account. | Usually configured per account. |
| Authenticator app | Stronger than password-only access; a code can still be surrendered to a phisher. | Requires the app and a setup or transfer process. | Save recovery codes and plan for a lost or replaced phone. | Usually configured per account. |
| FIDO2 security key | Designed to resist credential-phishing on compatible services. | Requires carrying and connecting or tapping the key. | Register a spare key or another recovery method. | One key can protect many compatible accounts. |
| Biometric unlock | Can unlock a device or passkey without typing a password into a phish. | Very convenient on supported devices. | Keep the device’s backup recovery method secure. | Depends on the device and account implementation. |
Common mistakes that make phishing easier
- Trusting a familiar logo: graphics can be copied in seconds.
- Assuming good grammar means genuine: professional-looking scams are common.
- Checking only the padlock: encryption does not establish who runs the site.
- Calling the number provided: the scammer controls that contact path.
- Replying to ask whether it is real: the reply may confirm an active address and continue the social engineering.
- Using the same password everywhere: one stolen login can unlock several services.
- Delaying after exposure: fast password changes, fraud reports, and session revocation reduce the attacker’s window.
A one-minute decision checklist
- Was this message expected and does it match something you actually did?
- Does the full sender address belong to the claimed organization?
- Is there pressure, a threat, a payment problem, a prize, or a request for sensitive information?
- Does the real link destination match the organization’s genuine domain?
- Is there an unexpected attachment or a request to call a supplied number?
- Can you verify the claim by opening the official app, typing the known address, or using a number from a bill or card?
If any answer raises doubt, do not interact with the message. Verify independently, report it, and delete it. If you already supplied information, secure the affected account first, then report the incident through the official channels.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
