Phishing scam: securing your accounts

What a phishing scam actually does

A message, an email, or a search result leads you to a page built to look like your bank, a courier, or a government site. Anything you type there, a password, an identity number, or a one-time password, goes straight to the person who built it.

Unlike an APK scam, nothing is installed on your device. The page alone is the trap, which is why it can catch someone careful just as easily as someone who clicks quickly.

Once your details are captured, they may be used within minutes or held for a later attempt, so acting as if the risk is immediate is the safer assumption.

Why the page looked so convincing

These pages copy real logos, layouts, and even the small print, often from a saved copy of the genuine site. The link itself is usually the only real clue: a misspelled domain, an extra word, or an address that does not match the organisation.

Pressure is part of the design too. A warning about a locked account or a limited time to respond pushes you to act before you look closely.

None of this reflects poorly on you. These pages are built specifically to pass a quick glance.

Securing your accounts in the right order

Change the password on the account the fake page pretended to be first, then move to any account that shares that password, starting with email since it can reset everything else. Turn on two-factor authentication wherever it is offered.

If the captured details included banking access, this overlaps with account takeover, so check whether anyone has already logged in or changed your contact details.

Do this from a device you trust, ideally not the one you used when you clicked the link.

Disputing an unauthorised transaction

If money has already moved, contact your bank immediately and describe what happened plainly: a fake page, a captured password or OTP, and the transaction you did not authorise. Read how a bank recall works so you know what to expect.

If the transaction was made by card rather than a direct transfer, a card chargeback may be the faster route, and your bank can tell you which applies.

A police report supports both routes and is worth making even while the bank’s process is ongoing.

What to do next

Keep the original message or email that led you to the fake page, since it shows how the scam reached you and helps any investigation. Report the page itself to your bank if they ask for it.

Watch your accounts closely for a few weeks afterwards, since captured details are sometimes used later rather than right away.

Acting on the accounts first and asking questions afterwards is the safer order here, even if it feels like overreacting in the moment.