So let's cut to the chase, you've been phished and you want to know what to do from here. Well first things first, don't panic. It'll take a bit of work but I'll go over the steps you need to take to protect yourself now, and then we'll go over how to avoid this in the future.

## 1. Call the bank and freeze your bank cards
This is probably the first thing you will want to do. Get ahead of the game stop what you're doing now and call the bank and stop whatever malicious activity is being attempted from happening. Tell them you're a victim of a phishing scam and you want to lock your account until it's safe again.

## 2. Change passwords in priority order
Next up you want to change your password as it is now compromised. The goal of most phishing scams is to get your password so they can then hack your account. I recommend changing your email address password first as this is often the key to accessing every other account you have. If you have reused this password before (don't worry most people have done this, just don't do it again!) then you will have to go and change every password on these accounts as well. 

## 3. Log out of all devices
If a user has managed to access your account then a quick way to get them out is by signing out of all devices. Many platforms offer this functionality.

## 4. Check the activity of any important accounts you have (Google, Gmail, Outlook, Facebook etc.)
This step is more of a double check than an action. Most people don't realise that websites often have activity trackers. For example in Google if you go into your account and view the security history you can see what devices have logged into your account, and where they come from. This can give you an idea of what has been hacked or not.

---

# What to do next
### Setup 2 factor authentication
This is an extrememly important thing to do. Using a multi factor authentication means that a user will need 2 forms of authentication to get into your account. This typically takes the form of a text message that you receive after entering your password. It's not guaranteed security but it is a huge step in the right direction. You should set this up on as many account as you can.

### Make sure all your passwords are different
Please please stop using the same password for every account. This will cause you such enormous headaches if you get phished again. By changing your password between websites you're taking away a huge area of attack for criminals

### Setup a password manager
This last step is a big one and may take some people weeks to get up and running, dependent on how many accounts they have signed up for. A password manager is a single place to store all your passwords. The password manager will generate stronger passwords for you on every website you visit and all you have to do is remember one single (and long) password for the password manager. You should set one up and over time gradually transfer your passwords to the password manager whenever you login to a new website. I strongly recommend doing this at the same time as the last step, then you can be resetting your passwords and adding them to the password manager in tandem.

### Train yourself to not be phished
We have a free phishing simulator that you can play [Phish Me If You Can](https://play.phishmeifyoucan.com "Free Phishing Simulator Test"), it uses real world phishing emails and monthly challenges to help more people become aware of what a phishing email is and how to avoid them by learning.

What to do if you've been phished

Most people believe they will never receive a phishing email thanks to their email provider moving all into the spam folder. However it is estimated that around 3.4 billion phishing emails are sent out every single day. This enormous number almost guarantees that some emails will slip through. Yes it's tiring being vigilant and questioning every single email you read but it could be the small difference in losing all of your investments / pension. 

Follow these 3 simple tips when reading or replying to emails in order to protect yourself. While there is no way to be 100% protected you can give yourself the best shot by doing this.

### 1. Check who sent the email
This is a standard check that everyone should do but I encourage you to take more notice to this. Very often criminals will use slightly different words or change a single letter in the email address in order to fool you into believing they are legitimate. 

But just as importantly even though the email address may look legit it could have been spoofed (made to look different to the actual email address of the person sending the email) OR that email address could have been hacked and is now being used to send malicious phishing emails.

### 2. Double check every link you click
This is the easiest thing to look out for. Most people are warned to never click a link however this is not true. Clicking a link is not inherently dangerous, but you must be aware of where it takes you. 

Hover over a link before you click it to see if the URL matches the domain of the company. To explain what that means: imagine you get an email from paypal asking you to reset your password but you see that the link takes you to www.palpay.com, this would indicate a scam since the link is different to the official website paypal.com. 

An easy solution to this problem which I try to do as often as possible is to just enter the the name of the website into google and find it myself rather than clicking the link. If you've been asked to urgently login to a website then there is no reason you have to do it by going through the link from the email. Google has a responsibility to show official websites so it will be much safer to go that way. 

### 3. If it's too good (or bad) to be true, then it probably is
This tip may sound a bit superfluous but is possibly the most important. If an email is encouraging you to do something urgently due to money reasons then there's a high chance it's a phishing scam. Just to give you a list of examples:

- you are owed a refund
- you won a prize
- you are about to lose your deposit
- you are about to lose a package / delivery
- someone you know needs immediate help

Before you do anything just give the person or organisation a call and confirm whether they sent the email. By doing this small step, especially when hundreds or even thousands of pounds are on the line, so many innocent people could have avoided being scammed. Just make sure to not use a phone number that was sent in the email!

---

So there are 3 basic rules, remember them in a simple way: 

1. check the email
2. check the links
3. question if it's real. 

This is the sad reality of having the power of email at our fingertips but the better we become at avoiding these phishing emails the less scammers there will be.  

Test yourself using real world examples of phishing emails in our free test [play here](https://play.phishmeifyoucan.com "Free Phishing Simulator Test")


3 ways to spot and avoid phishing emails

Phishing is not a new phenomenon. The first signs of phishing are thought to have been in 1995 - over 25 years ago. But what does phishing actually mean?

The literal definition is of a criminal pretending to be someone else in order to gain personal information from the victim, often by email or through phone calls. 

You might have heard of the most famous of these scams; a Nigerian Prince is unable to access his millions of dollars in wealth due to unforeseen circumstances and is looking for someone to wire him $5000 in order to retrieve it. That special someone will be rewarded handsomely for their kindness. Except the prize will never see the light of day. And the ‘Nigerian Prince’ has run away with your $5000.

This phishing scam has even become the source of many comedic jokes but the sad reality is that many thousands of people fall for these scams all the time, and often lose their life savings. And this is why phishing has become so widespread, it takes a criminal barely any time at all to set up a fake website, send a few emails and begin to pull in some serious money. 

The most common type of phishing scam is where what seems to be a reputable company such as Amazon, PayPal, Apple etc. is asking you to login to your account to do something. And when you click the link it will take you to a website that looks identical to the real thing, however it’s not owned by one of these companies, instead it has been set up by the scammer. Then when you’re there you enter your email and password which the scammer steals. These are extremely prolific scams so please be aware of these.

But the list of phishing scams these days is endless: pretending to be your bank, pretending to be a family member, your password needs resetting, blackmail phishing scams, fake prizes and competitions. It can feel a bit overwhelming and scary if you don’t know what to look for. I will give you two simple pieces of advice. 

1. If it seems too good to be true, then it probably is a scam
2. Always double check the links you click on.

There is much more to look out for but if you follow these 2 rules closely then you will massively reduce your risk of being phished. I go over these rules in depth in another article on this blog and explain a few more beneficial things you can do to protect yourself even further here - [3 ways to avoid phishing emails](https://www.phishmeifyoucan.com/articles/3-ways-to-avoid-phishing-emails "3 ways to avoid phishing emails").

So if phishing is as simple as sending an email and stealing your password, have you been phished? You’ll never know for sure, but look back at your previous emails and see if anything you read surprised you but you still clicked the link. Or if you were asked to refund, reset, reply urgently to anything that you don’t remember asking about first. If you think you have been phished then you should look to take precautionary measures. Firstly to protect yourself now but also, and importantly, in the future, so that it does not happen again. For a plan of action I strongly recommend you follow our article - [What to do if you've been phished](https://www.phishmeifyoucan.com/articles/what-to-do-if-youve-been-phished "What to do if you've been phished")


What is phishing? (and have you been phished)

I vividly remember the first time I was the 1 millionth visitor to my favorite website as a kid. I patiently waited outside the bathroom door while my Dad showered, in order to surprise him with what I thought was a gift from the internet gods - a free iPhone. 

I was utterly disheartened to learn that this wasn’t a scam. As I was able to confirm the following week, when I was once again informed that I was the 1 millionth visitor… 

Thankfully I had parents who were skeptical of such scams but little did I know that this would be the tip of the iceberg and become one of the greatest problems facing so many adults later in life.

So what is a scam? 

> In its simplest definition it is the act of fooling someone into giving away information or money. 

[Phishing scams](https://www.phishmeifyoucan.com/articles/what-is-phishing "What is phishing article") are an extremely common form of scam in the modern age, taking the form of emails or text messages.

Children are very susceptible to these scams, due to their curious and naive nature. The [FBI reported](https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf "ee") that the under-21 age group reported total losses in 2020 of roughly __$71 million__ (keep in mind this is just for America).

And this is just the scams that were reported to their hotline. It is a staggering amount of money and the problem is getting exponentially worse as hackers refine their strategies, and people use the web even more. Back in 2017 it was reported to ‘just’ be $8.3 million - meaning an increase of __758%__ to 2020!  

With all this data floating around you’d think that governments would be attempting to do something to protect children. And I guess you could say that they have tried: introducing minimum age requirements, improved legislation on advertising, forcing companies to improve the protection of young people. And yet the numbers speak for themselves - *it’s not working*.

Now I won’t lie and say that I spent all my free time swinging in the trees and rolling in the mud, but children these are spending unfathomable amounts of time on the internet. Ofcom reports [upto almost 4 hours of screen time per day](https://www.ofcom.org.uk/__data/assets/pdf_file/0013/220414/online-nation-2021-report.pdf "Ofcom Report 2021").

By the laws of the internet, the more time they’re online then the more chances of getting scammed. This is also reflected in the types of scams they are falling victim to. Social media and online shopping scams being the 2 most common [(Investopedia Reports - common scams targeted at teens)](https://www.investopedia.com/financial-edge/1012/common-scams-targeted-at-teens.aspx "Social media and online shopping scams being the 2 most common").

Hackers are taking advantage of childrens core reasons to use the internet and then targeting them directly. Social media is a new technology that even most adults don’t fully understand the power of yet. This means children are left in the dark when it comes to protection.

We can blatantly see what happens when children are not taught about scamming. This is not a simple case of “woops I lost my Club Penguin account”. We’re talking about lives being ruined, parents losing tens of thousands of dollars, identity theft and children being blackmailed.

Now you’re probably wondering, okay, now what? Children are notoriously tricky to teach things they do not care about. 

Earlier this year, schools in the UK ran a trial to teach mindfulness to pupils in order to tackle the very real crisis of child mental health. And somewhat surprisingly to the researchers, [the children reported seeing no improvements](https://consumer.healthday.com/b-7-13-u-k-school-study-finds-no-benefit-of-mindfulness-on-kids-mental-health-2657661316.html "the children reported seeing no improvements").

It goes to show that not every method will work, and realistically different ways of teaching work for different people. But I hope you can agree with me, that if we taught kids from a young age what scamming is, and most importantly how to be aware and catch scams early, it would have a positive shock wave across the entire general public. 

We can’t leave the whole task to corporations and the government. 10 minutes of learning a month could be the difference in avoiding a scam that would have cost us our life’s savings later in life. 

I believe the best way to learn - for both adults and children - is by example. Too many articles are out there that describe a scam without showing us what it actually is we’re looking out for. 

Now I’m not going to sit here and do the same. If you want to see some examples of real phishing scams then I built a free tool which acts as a simulated email inbox.

Over the years I’ve collected phishing scams, from my own inbox and from other people online. And to make it just that tiny bit more fun (no-one wants to revise after 5pm on a weekday..) it’s gamified with the goal of catching every scam email. But most importantly it’s free - so you have nothing to lose! -  [www.phishmeifyoucan.com](https://www.phishmeifyoucan.com/ "PhishMeIfYouCan free phishing email simulator").

Now this is obviously geared towards adults but I believe a similar tool aimed at children could prove invaluable. Children love competition and games. 

In small doses, semi periodically, we can open their minds to what a scam is. Then maybe next time they are the millionth visitor on a website they won’t bat an eyelid…


Blog

What to do if you've been phished

3 ways to spot and avoid phishing emails

What is phishing? (and have you been phished)

Why schools should teach children about scamming