How to Spot a Phishing Message Before You Click

Most people would say, “Do people still fall for fake links? Who believes a prize money scam anymore?”

Well, yes, they do. And it’s getting harder to spot, because the people behind these scams are getting smarter. They know you’re thinking the same thing, so they’ve built better stories, more convincing websites and more believable systems to get you to click.

Take this SMS: “Dear customer, your account has been restricted. Click here to verify your BVN within 24 hours.”

Your heart skips. You haven’t done anything wrong, but what if the bank really has a problem with your account? So you click.

That’s exactly what the sender wants. This is phishing, and it’s one of the most common ways Nigerians lose money, accounts and personal information. The good news is that most phishing messages still give themselves away if you know what to look for.

What phishing actually is

The word “phishing” comes from actual fishing, and the idea is the same.

A fisherman doesn’t chase the fish. He puts something tasty on a hook, sits by the water, and waits. The fish sees a free meal, bites, and by the time it realises something is wrong, it’s too late.

Phishing works the same way. The scammer doesn’t break into your account. He puts out bait and waits for you to bite. The bait is a message, an email or a link, dressed up as something you’d want or fear. The prize he’s after is access to you: your password, card details, BVN, OTP, or your money.

The common types in Nigeria

Fake bank alerts. “Your account has been debited” or “Your account is restricted.” The message includes a link to “resolve” it. The link leads to a page that looks like your bank’s website but isn’t.

Fake network provider messages. “Dear MTN customer, you have won ₦500,000 in our anniversary promo. Click to claim.” Airtel, Glo and 9mobile get impersonated the same way.

“You’ve won” messages. Prizes, giveaways and free data. If you never entered anything, you can’t win anything.

Fake job and loan offers. “Get an instant loan with no collateral,” or a job offer you never applied for, followed by a request for a “processing fee” or your personal documents.

WhatsApp impersonation. A message from a “friend” on a new number asking for urgent money or a verification code.

Seven warning signs

1. It rushes you. “Within 24 hours,” “act now,” “your account will be closed.” Scammers create panic because panic makes people stop thinking. A real bank doesn’t threaten you by SMS.

2. The link looks slightly wrong. Look closely at the web address. A real bank link will be the bank’s actual website. A fake one might be a misspelled version, have extra words, or end in something strange. If it’s a shortened link you can’t read, don’t click.

3. It asks for information your bank already has. No bank will ask you for your PIN, full card number, OTP or password by message or call. Never share these with anyone, including someone claiming to be bank staff.

4. It doesn’t know your name. “Dear customer” or “Dear user” is a red flag. Your bank knows who you are.

5. It’s too good to be true. Free money, free data, surprise prizes. If you didn’t enter anything, it isn’t real.

6. The grammar or formatting is off. Odd capital letters, spelling mistakes and clumsy wording are common, though better scammers have started cleaning these up. A well-written message isn’t automatically safe.

7. It comes from an unknown number or email. Check the sender. A bank email from a free Gmail or Yahoo address is fake.

What to do when you get a suspicious message

• Don’t click anything. Not the link, not “unsubscribe,” not “reply STOP.”
• Don’t reply or call the number in the message.
• Go to the source yourself. Open your bank’s app or type the website address directly. Or call the number on the back of your card. If there’s a real problem, you’ll see it there.
• Report it. Forward the message to your bank or network provider and block the sender.
• Tell someone. Parents, older relatives and friends are often the most vulnerable. Warn them.

What if you already clicked?

Don’t panic, but move fast.

1. If you entered a password, change it immediately, and change it anywhere else you’ve used the same one.
2. If you shared card or account details, call your bank right away and ask them to block the card or account.
3. Turn on two-factor authentication on your important accounts.
4. Watch your account for unusual activity over the next few weeks.

The rule to remember

If a message makes you feel scared or excited, stop and verify before you act. Those two feelings are exactly what scammers rely on. Take a minute, go to the official source, and check for yourself.

Written by Enigmaking, a web design and technical implementation studio.