Staying safe online · Lesson 2 of 5

Recognising phishing and scams

Messages that create urgency and ask you to click, log in or pay are the most common trap online. Go to the service directly instead.

Free — no account needed to read

Phishing messages pretend to come from someone you trust: a bank, a delivery company, a government office, your employer or a friend. They usually want you to click a link, enter a password, share a code or send money, and they often create urgency so you do not stop to think.

Common signs include a sense of panic ("your account will be closed today"), a sender address that is slightly off, links that lead to unfamiliar websites, requests for codes you were sent by text, and offers that seem too good to be true. Well-made scams can look very convincing.

The safest habit is never to act from inside the message. If your bank writes, open your bank's app or type its address yourself. If a friend asks for money in a strange way, call them on a number you already have. No real organisation will ask you for a one-time code.

See it happen

Aroha gets a text saying a parcel could not be delivered and she needs to pay a small fee through a link to rearrange it. She is expecting a delivery that week.

The first reaction

She is expecting a parcel and the fee is tiny, so paying quickly through the link seems like the easiest way to get it delivered.

With the idea

She notices the link does not match the delivery company's website. She opens the company's official app, sees her parcel is on its way with no fee, and deletes the text.

What changed

She checked through the official route instead of acting on the message.

Easy to take the wrong way

This does not mean every message is a threat or that you should never click a link. It means pausing before you log in, pay or share a code, and checking independently when in doubt.