Phishing scams: how they work and how to verify a message

The pattern

A phishing message usually impersonates a person, company, service or authority and creates a reason to act: a delivery problem, password reset, account suspension, invoice, security alert, prize, refund or urgent document.

The objective may be to steal credentials, collect payment details, install malware, capture a verification code or move you into a longer scam conversation.

Red flags that matter

• unexpected request to click or open something;
• urgency or threat of account closure;
• a login page reached through a message rather than your normal app/site;
• a domain that is similar to, but not actually, the organization’s domain;
• requests for passwords, codes or payment details;
• attachments you were not expecting;
• a message that asks you to ignore normal verification procedures.

Perfect spelling and branding do not make a message safe.

Can a legitimate domain host phishing? Yes.

Source review: October 15, 2026.

A reputable domain, old registration, genuine HTTPS connection or familiar hosting platform does not make every link, page or document on it safe. A legitimate website may be compromised and used to host an unauthorized phishing page. Scammers also abuse user-generated content, shared documents, application authorization flows and redirects from trusted services. Google explains that some dangerous pages appear on compromised sites without the owner's knowledge.

Verify the particular action, not just the domain:

1. Ask how you got the link. Did it arrive unexpectedly in a message, QR code, shared document or invitation? A familiar domain cannot verify who initiated the request.
2. Inspect the exact page and destination. A link can begin on a familiar host then redirect to an unrelated sign-in, payment or download page. Do not follow suspicious links just to test them.
3. Treat shared content separately. A real file-sharing or website-builder platform can host content uploaded by an attacker. Platform ownership does not establish the uploader's identity or the file's purpose.
4. Verify login or consent through your own path. Navigate using a saved official app or URL; verify unexpected app permissions, approval prompts and session requests independently.
5. Do not dismiss warnings. Browser and platform phishing protections help, but an unflagged page is not a clearance certificate. Even platform security checks may not scan every shared file immediately.

ScamMark's website and domain checker can provide registration and observable website signals. It cannot certify that a legitimate domain's individual pages, shared links, user accounts or OAuth applications are trustworthy. For a general verification method, read how to check a website.

Fake verification can be part of the phishing flow

A phishing link may lead to a fake CAPTCHA or “security verification” page rather than directly to a login form. If that page tells you to open Run, PowerShell, Command Prompt, Terminal or another system shell and paste or execute commands, stop. That matches the ClickFix safety pattern ScamMark treats as a high-priority deterministic warning.

How to verify

If a phishing message sends you to an unfamiliar website, the ScamMark Website & Domain Risk Checker can surface technical and registration signals worth investigating. Do not use a clean automated result as proof that the message or site is legitimate.

Use the official app or website you already know. If the alert is real, the same issue will often be visible there. If you need to call, find the number independently.

If a person you know sends an unusual link or money request, verify with them through a separate channel because their account may have been compromised.