A message says your account will close unless you act immediately. Another says a parcel needs a small payment. A third appears to come from a colleague sharing a document. The stories differ, but the decision in front of you is similar: should you trust this message enough to follow its instructions?
Phishing tries to turn that moment of uncertainty into disclosure, payment or another action that benefits the sender. This guide separates checking a suspicious message from responding after information has already been shared. It draws on Germany's Federal Office for Information Security, consumer guidance and official service-provider instructions checked on October 25, 2026. The examples are fictional; none is a live malicious message or link.
Start by leaving the message's route
Germany's BSI advises caution with unexpected links and attachments, including messages apparently sent by someone you know. If a familiar sender's message seems unusual, verify it through another contact route rather than using contact details supplied inside that message. [BSI: basic IT security guidance](https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/cyber-sicherheitsempfehlungen.html)
For an account notification, open the service through your established app or a known address. For a work request, use the organisation's usual communication channel. The useful change is not merely opening another window: it is obtaining the destination independently of the message you are checking.
Imagine a fictional parcel notice requesting a small additional charge. The small amount does not establish authenticity. The practical question is whether the delivery company, reached through your existing order or its genuine service, confirms the issue. Do not use the suspicious notice to provide both the claim and the method of verifying the claim.
This approach also avoids a common trap in advice about spelling mistakes. You do not have to prove a message is fraudulent before choosing a safer route to the real service. Uncertainty is enough reason to stop following its instructions while you check.
Appearance is evidence to examine, not proof
BSI's email-security guidance explains that phishing messages can be convincingly written and personalised using information from social networks or data leaks. It also notes that criminals can use AI to formulate messages. Good grammar, a personal greeting and a familiar subject therefore do not settle whether a message is genuine. [BSI: email-security myths](https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Sicherheitsirrtuemer/irrtuemer-e-mail-sicherheit.html)
The German consumer advice service similarly warns that names and convincing logos are not enough. It recommends contacting the real provider independently when a message cannot be reliably assessed, rather than replying to the suspicious email or using its supplied contact details. [Verbraucherzentrale: recognising phishing messages](https://www.verbraucherzentrale.de/wissen/digitale-welt/phishingradar/phishingmails-woran-sie-sie-erkennen-und-worauf-sie-achten-muessen-6073)
Think of the visible message as a set of claims: who sent it, why they are contacting you and what they want you to do. Examine those separately. A correct name might have come from a previous interaction or public information. A plausible reason might coincide with something you are doing. Neither automatically validates the requested action.
A useful habit is to describe the request in plain words. “This email wants me to enter my password on a page it selects” is easier to assess than “this looks like a routine account update”. The description brings attention back to the consequence of following the instruction.
Urgency changes the pressure, not the evidence
The consumer advice service identifies urgency, threatened consequences and demands for action as recurring features of phishing messages. Those features can appear alongside a link or attachment. [Verbraucherzentrale: phishing warning signs](https://www.verbraucherzentrale.de/wissen/digitale-welt/phishingradar/phishingmails-woran-sie-sie-erkennen-und-worauf-sie-achten-muessen-6073)
In a fictional example, a message threatens to suspend an account in thirty minutes. The deadline may make the request feel important, but it does not provide evidence that the sender controls the account. Check the actual service independently. If a real issue exists, the next steps should come from that verified service or its support channel.
An unexpected message can also use a helpful tone: a refund, a reward, an invitation or assistance with a supposed problem. Focus on what you are being asked to disclose or authorise. A friendly request and an alarming request can lead to the same risky action.
At work, make it normal to verify unusual requests without apologising for the delay. A routine check should not depend on whether the person named in the message seems senior or impatient. Follow the organisation's established process for payments, access changes and sharing documents.
A QR code does not make the destination trustworthy
Microsoft's security documentation describes QR-code phishing in messages, images and documents. Scanning can move the interaction from email to a mobile device and lead to a fake sign-in page. The same documentation describes attachments that contain further links or sign-in requests, rather than putting the final destination directly in the original email. [Microsoft: phishing techniques](https://learn.microsoft.com/en-us/defender-endpoint/malware/phishing-trends)
Treat a code in an unexpected message as another way of supplying a destination. It does not authenticate the sender. Moving from laptop to phone may feel like following a helpful instruction, but the question remains whether the request and destination are genuine.
For example, suppose a fictional workplace notice asks staff to scan a code to “restore access”. Do not assume that a code is required simply because the notice says so. Check the request through the company's normal IT channel. If the process is legitimate, staff can explain it without depending on the suspicious message as the sole source of authority.
Similarly, a document is not trustworthy merely because it opens normally. Reading a familiar file format and following a sign-in link inside it are separate actions. Evaluate the new request before proceeding.
If you received the message but did not act
Germany's federal service portal advises not replying to suspected phishing messages and not opening their links or attachments. It describes reporting phishing as an available action. [Bundesportal: reporting phishing mail](https://verwaltung.bund.de/leistungsverzeichnis/DE/leistung/99109014014000/herausgeber/BY-119184/region/090000000000)
For a work account, use your organisation's reporting process. For a personal account, use the service's reporting function or the appropriate local reporting route. Avoid sending an active suspicious message to a group of friends with a casual “is this real?” request. A description or redacted image is usually enough for a general conversation; an official investigation may need the original through its approved channel.
Do not click the link as an experiment. There is no need to visit a suspicious destination merely to strengthen a decision not to trust it. If you have not disclosed information or followed the instructions, keep the response proportionate: verify any underlying account issue independently, report appropriately and remove the message according to your usual process.
Record only what is useful. For an isolated personal message, a large incident file may be unnecessary. For repeated workplace messages, the time, claimed sender and nature of the request can help the security team recognise a pattern. Follow its instructions about preserving evidence.
If you entered a password or approved an unexpected request
The BSI's incident-response guide stresses regaining control of an affected account and ending active sessions, because an attacker may retain access through an existing session. If the password has already been changed by someone else, use the service's recovery process instead of repeatedly guessing passwords. [BSI: incident-response guide](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/CSN/Leitfaden_VP_VE.pdf?__blob=publicationFile&v=21)
Start from the real provider, not a recovery link supplied by the suspicious message. Change the compromised password through the official route and review the provider's instructions for signing out unfamiliar sessions. If the same password was used elsewhere, those accounts also need attention. Use different passwords rather than replacing one shared password with another shared password.
An unexpected authentication approval deserves prompt attention even if you did not type a password into a suspicious page. Tell the provider or workplace security team what you actually approved and when. Do not hide the action because it feels embarrassing. A precise account of events is more useful than a confident but incomplete explanation.
If it is a work account, inform the responsible team promptly and follow its recovery procedure. Avoid making broad changes to shared systems on your own. The account may connect to services whose recovery needs coordination.
Recovery involves more than a new password
Google's official compromised-account guidance includes reviewing recent security events, signed-in devices, recovery details and account access. For Gmail, it also points to unfamiliar filters or forwarding rules. These are examples of provider-specific checks that can reveal changes beyond the password itself. [Google: secure a compromised account](https://support.google.com/accounts/answer/6294825?hl=en)
Use that guidance for a Google account, and the equivalent official recovery guide for another service. Do not assume menu names or recovery options are identical across providers. A general checklist helps organise the work, but the service's current instructions should determine the exact steps.
Write down the changes you find and the actions taken. This can help distinguish an unfamiliar setting from one you changed during recovery. Keep the record private; it may contain sensitive details. If account access is still unavailable, use official support rather than paying someone who appears unsolicited and promises guaranteed recovery.
The UK's NCSC notes that account compromise can be subtle and that each cloud service has its own recovery process. A password-reset email or changed security setting can therefore warrant investigation even if the account still appears usable. [NCSC: recovering an account or service](https://www.ncsc.gov.uk/collection/using-online-services-safely/recovering-hacked-account-or-service)
If financial information or a device may be affected
Google's recovery guidance advises contacting a bank or relevant authorities when financial or identity misuse may be involved, and using trusted security software where harmful software is suspected. It does not make an ordinary password change a complete remedy for every possible compromise. [Google account recovery guidance](https://support.google.com/accounts/answer/6294825?hl=en)
If banking information or a payment was involved, contact the bank through a verified channel promptly. Explain whether you disclosed details, approved a transaction or noticed an unauthorised payment. Those are different situations. Do not use a telephone number supplied in the suspicious message to seek help with the same message.
If you opened an unexpected file or installed software, tell your workplace IT team or a trusted support professional exactly what happened. Avoid installing a supposed cleaning tool advertised by the same page or caller. Preserve useful details without continuing to interact with the suspect material. No short article can determine whether a device is clean from a description alone.
Strengthen future sign-ins without assuming immunity
BSI explains that a second authentication factor can protect an account when a password is exposed. It also warns that a fake page can capture both a password and a one-time code in real time. Passkeys avoid handing over those same reusable secrets and offer a more phishing-resistant approach where supported. [BSI: email and authentication myths](https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Sicherheitsirrtuemer/irrtuemer-e-mail-sicherheit.html)
Use the service's official security settings to review available options. Make sure you understand account recovery before changing how you sign in. Store recovery information securely and keep recovery contact details current. A stronger sign-in method should be part of a workable account setup, not an isolated feature enabled without knowing how to recover access.
Do not approve prompts you did not initiate or share codes with someone claiming to provide support. Continue verifying unusual requests even after improving authentication. Security features reduce particular risks; they do not make every message, payment request or document-sharing instruction trustworthy.
Build a small routine that people will actually use
A household or small team can practise with a fictional example without sending a real malicious link. Ask three questions: what does the message claim, what does it want, and how can the claim be checked independently? Keep the exercise focused on decisions rather than on catching someone making a mistake.
Agree on a known way to verify urgent requests between people. For a team, that may be an established internal channel and approval process. For family members, it may be a call using a number already saved. The purpose is to avoid allowing the incoming message to define every part of the verification.
When someone reports a mistake, respond with the next useful action. Blame can delay disclosure and make the facts harder to establish. A calm response does not minimise the incident; it helps the people responsible act on accurate information.
Conclusion
The strongest everyday habit is to verify important requests outside the message that delivered them. If you have already acted, describe precisely what happened and use the real provider's recovery process promptly. Combine that habit with appropriate authentication, current recovery details and a clear reporting route. You do not need to become an expert in every phishing technique to stop giving suspicious messages control over the next step.
Research date: October 25, 2026. General security education; follow your provider's and organisation's incident instructions. Original AI-assisted editorial text and generated illustration. The image shows a fictional workspace, with no real message, malicious link, password or personal data.