How to Spot and Avoid Phishing Scams

By NorwegianSpark Editorial · Published July 10, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

Phishing is the single most common way ordinary accounts get compromised, and it works because it targets people rather than software. A phishing message — by email, by text (often called smishing), or even by phone — impersonates a company or person you trust and pressures you into clicking a link, opening an attachment, or handing over a password or one-time code. The reassuring part is that once you know the pattern, most attempts are easy to spot.

The tells are consistent. Manufactured urgency ("your account will be suspended", "confirm your payment now"), a sender address or link domain that is almost-but-not-quite right, requests for credentials or verification codes that a legitimate company would never ask for by message, and oddly generic greetings. The most reliable rule, per the US Federal Trade Commission (2026), is simple: real companies do not email or text you a link to update payment or login details — so never act on the link inside the message. Instead, reach the company through a phone number or website you already know is genuine. Lookalike domains are a favourite trick, and if you register or manage domains yourself, our sister resource TopDomainAgent is a useful primer on just how close a typosquatted address can look to the real one.

No single product stops phishing, but layers make it much harder to fall for one and much less damaging if you do. Antivirus suites with web and scam filtering — Bitdefender and Norton both include anti-phishing and malicious-site blocking as standard features — catch many known-bad links before the page even loads. A password manager is a quietly powerful defence too: NordPass only autofills your saved credentials on the exact domain it stored them for, so on a convincing fake that does not match, it simply stays silent — and that silence is your warning. Two-factor authentication then means a stolen password alone is often not enough; our two-factor authentication guide ranks the methods, while passkeys go a step further by being phishing-resistant by design.

Phishing is where a great many breaches and identity-theft cases begin, so it connects to the rest of your defences: a password manager, the broader habits in protecting your privacy online, and knowing what to do after a data breach if a scam does get through. Slow down on any unexpected message, verify through a channel you already trust, and never enter credentials from a link you did not expect. General guidance, not advice for a specific threat model.