Everything looks real. Except the link.
Spot a fake message before handing over your password.
Pause first
“Your account will be blocked,” “confirm this payment,” “ten minutes remaining.” Urgency pushes you to act before checking. If a message demands an immediate click, stop and verify the request first.
Check the address, not the design
Logos, signatures and familiar colors are easy to copy. Inspect the full sender address and the link’s domain. A recognizable brand name inside a long address does not mean the site belongs to that service. Even a secure-connection indicator does not establish that the operator is trustworthy.
Open the service yourself
Use a saved bookmark or the official app instead of the message’s link. Check account notifications or contact support through the official website. Do not use contact details supplied in the suspicious message.
If you already entered a password
Open the genuine site on a trusted device, change your password and end unfamiliar sessions. Replace that password wherever else you reused it. Review recovery methods. If you shared payment details, contact your bank immediately.