# The message that knows just enough about you.

Knowing what to look for · 01 · 9 min read

A text says your package is stuck. An email says your account closes tonight, and it uses your name.
For one second you believe it, and that second is the whole point.

This page helps you:

- Tell a fake text or email from a real one
- Know which clues matter most, and which matter less
- Check a message without using its link or number

Phishing is a message built to make you follow its instructions before checking who sent it. By
email it is usually called phishing. By text, you may see smishing; by phone, vishing. The labels
matter less than the move underneath: borrow a name you trust, then give you a reason to hurry.

These messages are written and tested much like advertising. They are meant to catch people while
attention is elsewhere, not only people who lack technical knowledge. A few repeatable checks are
more dependable than trying to feel whether a message looks genuine.

## One trick, four doors

The same pressure can arrive by text, email, call, or QR code. The channel changes, but the request
still needs an independent check.

- By email · **Phishing**: A message dressed as a company you use, carrying a request you did not
  start.
- By text · **Smishing**: A short text about a package, a toll, or a bank alert, built for one quick
  thumb-tap.
- By voice · **Vishing**: A call with a real-sounding reason to act, now sometimes in a voice cloned
  to sound like family.
- By QR code · **Quishing**: A code on a meter, flyer, or email that hides its destination until
  your camera reads it.

Below we take apart an email, because you can study one at your own pace. Voice has its own chapter
now that a familiar sound can be cloned:
[AI scams and deepfakes](https://explained.withpersona.com/your-identity-online/ai-scams).

## Here is one that almost works. Select any marked part to unpack it.

**About these addresses:** Every address on this page is made up. They end in .example instead of
.com, because .example is set aside for examples and can never belong to a real site. Real addresses
end in .com, .org, .co.uk, and many others. You read them the same way.

```
From
Apple Support <security@apple.com-account-verify.example>

Subject
Action required: your account will be locked in 24 hours

Dear Valued Customer,

We detected an unusual sign-in to your account. For your protection it has been temporarily limited. You must verify your details, or your account and all purchases will be permanently deleted.

Verify my account: apple.com-account-verify.example/login

Please confirm your Apple ID, password, and card number to lift the hold.
```

**Choose a clue to unpack**

- **The address is almost right**: It starts with "apple.com", but a hyphen joins that to more
  words. The whole name, apple.com-account-verify.example, is a different domain from apple.com.
  Compare it with the address you normally use.
- **The subject creates a deadline**: "Locked in 24 hours" creates pressure to act before checking.
  A deadline alone does not prove a scam, but it is a reason to open the real app or site yourself.
- **"Dear Valued Customer"**: A generic greeting can appear in both legitimate and fake messages. It
  is a weaker clue than the sender address, link, and request for sensitive information.
- **The link does not match the brand**: The hostname is "apple.com-account-verify.example", not
  apple.com. If you are not sure where a hostname ends, close the message and open the service's app
  or site yourself.
- **It asks for your password and card**: A password and full card number are not details to confirm
  through an unexpected message. Close it and check the account from the app or site you normally
  use.

**What matters most**: The generic greeting is weak evidence. The unrelated domain and request for a
password and card matter much more. Close the message and check the account through a route you
chose yourself.

## Read the same pattern in a text

A text leaves less context to examine than an email. The clues are the same, but they fit into fewer
words. Select any marked part to unpack it.

```
+44 7700 900142
Today 08:14 · SMS

ROYAL MAIL: Your parcel is held at our depot. A redelivery fee of £1.99 is unpaid.

Pay the £1.99 fee within 24 hours to arrange redelivery.

roya1mail-redelivery.example/pay

You will be asked for your card details to release the parcel.
```

**Choose a clue to unpack**

- **A number you did not already associate with the courier**: A sender name or number is not proof
  of who sent a text. Check the delivery through a reference or official app you already have.
- **A small fee, to lower your guard**: A small "redelivery fee" is meant to feel too minor to
  question. Do not use the link to decide whether it is real. Check the delivery through the
  courier's official site or app.
- **A look-alike web address**: "roya1mail" uses the number 1 in place of the letter l. More
  importantly, the address ends in "redelivery.example", not the courier's domain.
- **It wants your card to "release" the parcel**: An unexpected request for card details needs an
  independent check. Open the courier's official site or app yourself before entering anything.

**What matters most**: The strongest clue is the path the text sets for you: its own link, followed
by a card request. If you are expecting a parcel, leave the message and check the tracking reference
in the courier's real app or website.

The story changes with the country and the season. It may be a toll, tax refund, account check, or
missed delivery. The useful question stays the same: does the message want you to use its link or
number before you can check the claim elsewhere?

## If you already tapped it

What matters next is what the page received or changed.

Close the tab and do not return through the same link. Then check whether you entered information,
downloaded anything, or approved a permission. The next steps depend on which of those happened.
Here is
[what to check after a click](https://explained.withpersona.com/your-identity-online/clicked-a-link).

## When it seems to come from someone you know

A familiar name is not proof it's them.

Sometimes the message carries the right name and even continues a real reply thread. The displayed
sender can be forged, or the account itself may have been taken over. Replying keeps you inside the
one channel you are trying to check. If the request involves money, a login, or a one-time code,
reach the person through a number or app you already had before the message arrived.

## Check the hostname, then use a route you trust.

A misleading link can pack trusted words into an address without using the exact domain you
expected. In this deliberately simple illustration, "apple.com" appears inside the hostname, but the
address belongs to account-review.example, which is not Apple's site. Real domain endings vary, so
this is a worked comparison, not a parsing test you have to pass. When the address is hard to read,
open the service through its app, a saved bookmark, or an address you already trust.

```
Sign in
https://support.apple.com.account-review.example/signin/apple/id
```

The full hostname ends in account-review.example, not "apple.com". The Apple words sit to its left.
This worked example is not a universal "last two parts" rule. With a real link, close the message
and use a route you trust if the hostname is not immediately clear.

Illustrative address. Many phones let you press and hold a link to preview it before you tap.

> For a second, you believe it. These messages are built to take advantage of that half-second
> before you really start thinking: while you are mid-task, in motion, or only half-listening.

## Why it works, even on careful people

The wording changes, but many fake messages use the same levers. Naming them helps you pause before
following the message's instructions. No single clue proves who sent a message, so check the request
through a channel you choose yourself.

- **Authority.** A bank, a boss, or a public office. An official name can make an instruction feel
  settled before you have checked it.
- **Urgency.** A deadline that leaves no room to open the real account or ask someone else.
- **Fear.** A threat to your money, account, or family can make the offered fix feel like the only
  move available.
- **Familiarity.** Your name or a real order detail can be borrowed from another source. Knowing
  something about you does not prove who sent the message.

## Unlearn this

Bad spelling was never a reliable test, and it is less useful now.

A fake message can copy the real design and use polished grammar. Spelling alone does not tell you
who sent it. Look at the request instead. If a message asks for a password, one-time code, or full
card number, do not provide it there. Open the company's official app or site yourself and check
what it needs.

## Habits worth keeping

**The message's route, or yours**

- **A deadline**
  - The route it hands you: Act inside the message before time runs out
  - A route you already trust: Close it and open the account yourself. Real account activity will
    still be visible.
- **A link in an email or text**
  - The route it hands you: The link in the message
  - A route you already trust: An app, saved bookmark, statement, or card you already had
- **A search for the company**
  - The route it hands you: The first search result, which can be an advertisement imitating it
  - A route you already trust: The app or bookmark you already use
- **A QR code**
  - The route it hands you: Treat the code as proof the page belongs to the name beside it
  - A route you already trust: Preview the destination first. A QR code is a link in another form.

The message sets a route for you. The habit is to leave it and use one you already had.

1. Use the report option in your email or messaging service if it offers one. Check the provider's
   own instructions before forwarding a message or sending it to a reporting number.
2. If you already tapped, typed, downloaded, or approved something, the next step depends on what
   happened. Here is
   [what to check after a click](https://explained.withpersona.com/your-identity-online/clicked-a-link).

Reviewed July 2026. These habits follow phishing guidance from the
[FTC](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) and the
[UK NCSC](https://www.ncsc.gov.uk/guidance/suspicious-email-actions).

---

_Part of Identity Explained (by Persona).
https://explained.withpersona.com/your-identity-online/fake-messages_