Spot the Phish: A 10-Second Check (and How to Report It So It Helps Others)

October 18, 2026 • Cybersecurity

It's the spooky season, so here's the only trick worth worrying about: the fake email or text designed to trick you into clicking. It's called phishing, and it's behind most of the scams that hit folks around Winchester. The good news — once you know the handful of tells, you can spot one in about ten seconds. And there's a second half almost nobody does, that we'll get to: reporting it, which actually helps protect your neighbors.

The 10-second check before you click anything

You don't need to be technical. You just need to slow down for ten seconds and run through these:

• Is it pushing you to hurry? "Your account will be closed!" "Act in 24 hours!" Urgency is the scammer's favorite tool — it's designed to make you click before you think. Real companies don't operate this way.
• Check who it's really from. The sender name might say "Amazon," but the actual email address is something like service@amaz0n-billing.ru. On a computer, hover your mouse over the sender or the link (don't click — just hover) and the real address shows up.
• Were you expecting it? A receipt for something you didn't buy, a delivery notice for a package you didn't order, a "your password was changed" you didn't change — those are bait designed to make you click in alarm.
• Does it want you to confirm something you'd never need to? No real bank emails you asking for your password, your PIN, or a code. Ever.

If any of those flags go up, don't click the link and don't open the attachment. When in doubt, go to the company the way you normally would — type their website in yourself, or call the number on the back of your card — not through anything in the message.

This season's flavors

Phishing follows the calendar. Heading into the holidays, expect a wave of fake charity sites (especially after any disaster in the news), fake "your package is delayed" delivery texts, and too-good-to-be-true shopping deals. The check above handles all of them. When a charity appeal arrives, give through the charity's own website rather than a link someone sent you — same idea as the bank.

The part almost nobody does: report it

Here's the half that turns you from a target into part of the defense. When you get a phish, take a few seconds to report it — it helps the systems that protect everyone get smarter, and it can get scam sites taken down faster.

• In your email, use the "Report phishing" or "Report spam" button instead of just deleting it. That teaches your provider's filter to catch the next one before it reaches you or your neighbor.
• Forward suspicious texts to 7726 (it spells "SPAM"). Your phone carrier uses these to block scam numbers.
• If it's pretending to be a real company, most big ones have a reporting address — and you can report scams to the Federal Trade Commission at reportfraud.ftc.gov.
• If money or an account was actually involved, call your bank directly using the number on your card.

Deleting it protects you. Reporting it protects the whole neighborhood.

Want to practice spotting them with real examples? The Stay Safe Online: Spotting Email Scams microcourse in Skits' Classroom is free and walks through the tells in about ten minutes.

"I think I already clicked something"

First — don't panic, and don't be embarrassed. These are built by professionals to fool careful people. If you clicked a link and entered a password, change that password right away (and turn on two-step from last week). If you entered card details, call your bank. And if you're not sure how bad it is or what got exposed, that's a fine reason to call us. We'll help you figure out what happened and shut the door calmly: 540.303.2410.