What is phishing? Phishing is an attempt to trick someone into revealing private information, opening a harmful link or attachment, sending money, or approving an action they did not intend. The attacker pretends to be trustworthy: perhaps a bank, school, employer, delivery company, friend, or government service. The message can arrive through email, text, messaging apps, social media, a website, or even a telephone call. The defining problem is deception, not the particular device used.
The most useful response is simple: pause, check the claim independently, and use the official service you already know. A sender name, convincing logo, familiar-looking website or urgent deadline is not proof of authenticity. If somebody asks you to sign in or transfer funds, open your bank app or type the organisation’s address yourself rather than trusting a link in an unexpected message.
Quick notes: Phishing = a deceptive lure. Smishing = a text-message phishing attempt. Vishing = voice-based phishing. Spoofing = a disguised identity or origin, which may help a phishing attack. Common warning signs include urgency, secrecy, unexpected payment instructions, requests for passwords or verification codes, and links that do not lead where they appear to. If you already responded, protect the affected account immediately and contact your bank or relevant service through established channels.
What phishing actually means—and what it does not
The word phishing is often explained as ‘fishing’ for information. That picture is useful: a lure is presented, the person is encouraged to bite, and the attacker hopes to catch an account, identity, payment or device. But phishing is not defined only by successful theft. A fraudulent email asking for a password is still an attempted phishing attack even when nobody replies.
Not every unexpected email is phishing. An ordinary appointment reminder, promotion or mistaken message might be inconvenient but genuine. Conversely, not every phishing message contains an obviously suspicious attachment. Some attacks merely ask you to approve a sign-in, telephone a fake support team, scan a QR code or send a small ‘verification’ payment. The correct question is: Who is asking me to do what, and how can I independently verify that request?
This distinction helps students, parents and employees avoid two bad extremes. One is believing every professional-looking message. The other is assuming that every digital request is fraudulent. Reliable digital literacy means gathering evidence before acting.
How a phishing attack works: the five-part mechanism
- A credible identity: The attacker imitates a person, business, department or online service the recipient might recognise.
- A reason to respond: The message claims a parcel is delayed, an account has been locked, a school form is missing or a payment has failed.
- A pressure cue: Urgency, fear, an attractive reward or the appearance of authority encourages a fast reaction.
- An unsafe action: The recipient is asked to enter credentials, disclose a one-time code, download a file, call an impostor or approve an unexpected payment.
- An attempted payoff: The attacker may take over an account, steal money, install malware or collect information for a later fraud.
The key turning point is step four. A person may read a fake message without suffering a loss. The risk increases when they enter information, run untrusted software or authorise a transaction. That is why good advice distinguishes receiving a message, clicking, entering credentials and approving a payment; these are not identical events.
Consider a fictional message: ‘Your school activity fee is overdue. Your child loses the place in 20 minutes unless you pay here.’ A parent has a real interest in the activity. The message uses that concern to manufacture urgency. The safe test is to consult the school’s existing communication channel or parent portal. Do not treat a plausible school name as verification.
Six warning signs worth understanding
1. A deadline that removes time to check
Scammers often use language such as ‘immediate suspension’, ‘final notice’, or ‘you must respond today’. Real organisations sometimes have deadlines too, so urgency alone is not proof. The warning arises when the message pushes you to act before you can independently verify it.
2. A request for credentials, recovery codes or approval
Passwords, one-time passcodes, authentication app approvals, banking PINs and account recovery information should never be given to an unexpected caller or entered into an unfamiliar page. Even a request that appears to come from a friend can be suspicious if that person’s account has been compromised.
3. A changed destination or payment method
A familiar company may be impersonated by a lookalike domain or altered payment details. The visible text of a link can differ from its actual destination. On a mobile phone, the full domain may be hard to inspect. The safer method is to navigate independently to the known official app or bookmarked site.
4. A request to keep the conversation secret
Secrecy prevents second opinions. A supposed bank officer who says ‘do not tell the branch’ or a fake official who discourages discussion is making verification harder, not easier.
5. A mismatch between the message and your actual activity
A delivery charge for something you never ordered, a password reset you did not request or a school form sent to the wrong family may indicate fraud. A mismatch is a reason to investigate, not a reason to respond to the sender.
6. An unexpected attachment, app or remote-access instruction
Documents and applications can be used to distribute malware. Installing an unknown application, enabling unusual permissions or giving remote access to an unsolicited ‘support technician’ can turn one mistake into broader device or account exposure.
Three worked examples: learn to identify the unsafe moment
Example A: the delivery notification
A text says: ‘Parcel held. Pay a small redelivery fee.’ The message shows a courier logo and a short link. The risk is not only the small amount: the destination may request card details, identity data or additional verification. A careful recipient opens the retailer’s order history or the courier’s official app using a known route. If no parcel is expected, that mismatch reinforces the need for caution.
What to teach: ‘A small amount of money’ does not imply ‘a small amount of risk’. The payment page can be the information-collection step.
Example B: the account-security alert
An email claims a school account has been accessed overseas and presents a prominent ‘Secure now’ button. The student feels anxious. They instead open the school login page from their normal bookmark and check recognised notifications or contact school IT through established details. A security-themed message is not automatically trustworthy just because it discusses security.
What to teach: when a warning and its proposed solution arrive in the same unverified message, verify the warning independently before following the solution.
Example C: the unexpected authentication prompt
A person receives a sign-in approval request they did not initiate, followed by a caller claiming to be technical support: ‘Press approve so we can stop the hacker.’ The safe response is to deny the unexpected prompt, avoid sharing codes and contact the service through its official support route. The caller may be attempting to turn a security control into an access method.
What to teach: multi-factor authentication is protection only when the person understands and controls the approval.
How to check a suspicious message without making the situation worse
- Stop the proposed transaction. Do not hurry into a login, download, call-back or money transfer.
- Separate appearance from evidence. Write down who the message claims to be from and what it wants. A familiar display name remains only a claim.
- Open a new, trusted route. Use a known banking app, official website entered independently, saved phone number or an established school communication channel.
- Compare the request. Does your real order, account or school portal show the same issue? Can a genuine staff member confirm it?
- Report or delete appropriately. Use your organisation’s reporting process, email service’s report-phishing feature or an official scam-reporting channel.
Do not reply to the suspected sender merely to ask whether they are real. That invites another persuasive answer from the same unverified source. Do not forward a live malicious link to classmates as a teaching example either. Use invented examples or a screenshot that hides private details, and follow local reporting guidance.
What if you already clicked a link?
The right action depends on what happened. Clicking an unfamiliar link is not the same as entering a password, installing software or authorising a bank transfer. Identify which event occurred. If you only opened a page, close it and review your browser and device for unusual downloads or permission prompts; if you installed something, seek trusted technical help promptly.
If you entered a password on a suspicious page, go directly to the legitimate service through a trusted route and change the password. Change reused passwords elsewhere too. Review recent account activity, sign out of other sessions where possible, enable appropriate multi-factor authentication and inform the service or organisation of the exposure. If you shared a verification code or approved an unexpected sign-in, treat the account as potentially compromised and contact the provider urgently.
If a financial transfer or card exposure is involved, contact your bank immediately using the number in its official app or on the card. Follow its fraud-reporting and account-protection instructions. If this occurred at school or work, tell the appropriate IT or security team quickly; early reporting can help protect others.
Phishing in Singapore: practical routes for families and students
Singapore’s ScamShield provides scam-awareness resources and ways to check suspicious calls, messages and websites. Its official helpline is 1799; the published service describes it as available around the clock. This is an official checking route, not a replacement for contacting your bank promptly if a payment or account is at risk.
The Cyber Security Agency of Singapore also provides cyber-hygiene guidance. The useful family rule is independent verification: a child should be able to say, ‘I will ask an adult and check the real school channel,’ without feeling embarrassed or pressured.
For a Singapore-specific explanation of agencies, incident reporting and national cyber roles, read How Singapore’s Cybersecurity System Works. For a vocabulary lesson distinguishing channels and false identities, see Smishing, Vishing and Spoofing Explained.
Phishing, spam, malware and hacking: do not mix them up
- Spam: unsolicited messages, which may be harmless, annoying or malicious. Not every piece of spam is phishing.
- Phishing: deceptive persuasion intended to induce an unsafe action. It may or may not involve software.
- Malware: malicious software. Some phishing messages distribute malware, but many simply use fake forms or payment instructions.
- Spoofing: disguising an apparent sender, caller or origin. It can support phishing but is not identical to it.
- Account takeover: the consequence of an attacker gaining control of an account; phishing is one possible route.
- Social engineering: the larger category of manipulating human decisions; phishing is one common form.
Using the correct word is not pedantry. It helps determine what has to be protected. If a password was typed into a fake page, investigate account exposure. If unknown software was installed, investigate the device. If a caller requested money, investigate the financial transaction. A diagnosis is useful only when it points to the right action.
How students, parents and teachers can practise safely
For a primary-school child
Use three fictional paper messages. One is a normal reminder, one is a message with a suspicious payment link, and one is an unexpected verification-code request. Ask: ‘Who claims to be speaking? What do they want? Who can I ask?’ The goal is not technical jargon; it is the habit of refusing a rushed decision.
For a secondary-school student
Add questions about domains, sender identities, app permissions, two-factor authentication and evidence. Ask the learner to justify a safe verification route without opening any live suspicious URL. The best answer should explain why a logo or HTTPS padlock does not establish an organisation’s honesty.
For an adult or workplace team
Rehearse what to do if an invoice changes bank details, a colleague requests a confidential file through an unfamiliar channel or a sign-in alert appears. The response should have named reporting contacts and a route for urgent banking incidents. Training should reward prompt reporting, not punish people who admit they made a mistake.
A simple seven-day learning sequence
- Day 1: Explain phishing in one sentence, then distinguish message, identity claim and requested action.
- Day 2: Compare a normal school reminder with a fictional fee scam.
- Day 3: Explain smishing, vishing and spoofing with different examples.
- Day 4: Practise opening a service independently instead of following an unexpected link.
- Day 5: Rehearse a fake unrequested authentication prompt and a safe response.
- Day 6: Write an account-recovery checklist without using any real password or personal record.
- Day 7: Face a new invented scenario and explain the decision without hints.
A learner has understood the topic when they can handle a new-looking message, not merely recognise the wording of an old example. This is the difference between memorising warning signs and developing an evidence-based habit.
Five common mistakes—and the repairs
- ‘It has an official logo, so it is genuine.’ Logos can be copied. Verify through an independent route.
- ‘The link begins with HTTPS, so the business is honest.’ HTTPS helps protect a connection but does not prove the site’s owner is trustworthy.
- ‘It is only a small payment.’ A small charge can be the start of card or identity exposure.
- ‘Multi-factor authentication means nobody can trick me.’ Unexpected approval prompts and disclosure of codes can defeat careless use.
- ‘I should hide the incident because I feel embarrassed.’ Reporting promptly may limit damage and help protect other users.
Frequently asked questions about phishing
What is phishing in one simple sentence?
Phishing is an attempt to deceive you into sharing secrets or taking an unsafe action by pretending to be a trusted person or service.
Can phishing happen through WhatsApp or a QR code?
Yes. The technique can arrive through many channels, including messaging apps, social platforms and QR codes. The core issue is the fraudulent request and the action it tries to produce.
Does a spelling mistake prove a message is phishing?
No. Poor spelling can be a warning sign, but well-written scams exist and genuine messages can contain mistakes. Do not make typography your only test.
Can a phishing email come from a real person’s account?
Yes. A compromised account may be used to contact friends or colleagues. Verify unexpected requests even when the sender looks familiar.
What should a school tell students to do first?
Stop, do not disclose information, and check with a trusted adult or recognised school channel. The child’s safety matters more than explaining technical details perfectly.
What is the difference between phishing and hacking?
Phishing manipulates a person’s decision; hacking broadly describes unauthorised technical intrusion. Phishing can help an attacker gain access, but the concepts are not the same.
Should I use the link in a suspicious message to report that same message?
No. Use a known official reporting route instead. The sender’s instructions are part of the unverified message.
Where to go next
If you want to understand the protective technology, read Firewalls, Anti-Malware and Encryption. To learn how a VPN does—and does not—protect a connection, go to What is a VPN?. A safe digital habit is valuable because it transfers from school email to banking, shopping and working life.
Sources and verification
For authoritative practical guidance, use ScamShield’s official service guide, ScamShield’s checking guidance and CSA’s Stop and Check advice. Teaching examples in this article are fictional. Exact reporting and bank-protection procedures can change; consult the relevant current official service.