Three delivery messages, and which one is real
Fraudulent parcel texts no longer look fraudulent. Three structural tests separate them from a genuine notification, and one fifteen-second habit defeats all of them.
Tag
#Phishing
SIM swap: how a phone number stops being yours
Nothing is hacked. The number is moved by the company that owns it, on a request that looked legitimate — and your phone losing signal is the only warning you get.
The filter scam that asks you to log in first
The filter is the packaging; the login is the product. Why a real effect never needs your social password on another website, and what to do in what order if you gave it.
The OTP code you were told to read out
The message arrives from the right number, because they caused it to be sent. Why the request itself is the answer, and the one method that cannot be spoken aloud.
The support chat that opened by itself
Because you arrived rather than being contacted, every instinct about unsolicited approaches is disabled — and searching for a helpline is how most people get there.
The refund that needs your bank details to process
Being owed money switches off the caution that being asked for money turns on. One fact disqualifies nearly every version of it, and small businesses get the inverted variant.
Where bulk messaging stops being outreach and becomes spam
The tool that lets a shop message a customer is the same tool that lets a scammer message ten thousand strangers. The difference is not technical.
How to read a URL properly
The part of a web address that decides where you are going is not where most people look. Reading it correctly takes five seconds and defeats most phishing.
SMS codes, authenticator apps, passkeys: which actually stops account takeover
All three are called two-factor authentication and they are not equivalent. Two of them can be phished in real time; one cannot, for a structural reason worth understanding.