What Is Phishing?

What phishing means

Phishing is a tactic in which someone sends a message designed to look genuine, hoping you will reveal personal details such as passwords or card numbers, or click a link that leads to a fake page. The message might arrive by email, by text, or even as a phone call, and it is often crafted to imitate a source you already trust so that you lower your guard.

The whole approach relies on you believing the message is what it claims to be. Knowing that phishing exists, and that any unexpected message could be an attempt, is the first and most useful step in protecting yourself. Once you treat surprising requests with a degree of healthy scepticism, the tactic loses much of its power, because phishing depends entirely on catching you while your guard is down.

Common signs

Phishing messages tend to share a set of recognisable features, and spotting even one of them is good reason to pause before you respond. The more of them a message carries, the more cautious you should be.

• A sense of urgency or threat, pushing you to act fast.
• Links or web addresses that do not quite match the official site.
• Requests for passwords, one-time codes, or full card details.
• Unexpected attachments, or small errors in wording and layout.

Any of these should make you stop and think rather than click or reply. Genuine organisations do not ask you to confirm sensitive details by following a link in an unexpected message, so a request of that kind is itself a strong signal that something is not right, however polished the message may appear.

Safe habits with links

Treat links and attachments in unexpected messages with real care, because a single click can be all it takes to reach a fake page. Rather than clicking, go directly to the official website by typing the address yourself or using a bookmark you already trust, and find what you need from there. This habit protects you even when a message is very convincing, since you never rely on the link it provides.

If a message claims to be from Merion, our official website is merion.com.au, and you can verify any message by reaching us through our official channels rather than through the message itself. Our guidance on the details you should never share explains what a genuine message will never ask of you, which makes a phishing attempt much easier to spot for what it is.

If you have been caught out

If you clicked a phishing link or entered some details, act promptly rather than hoping it will not matter. Change any affected passwords, contact your bank or card provider if you shared payment information, and run a security check on your device to be sure nothing was left behind. The faster you respond, the more you limit any potential impact, and the first steps you take are usually the most valuable.

You can report phishing to Scamwatch at scamwatch.gov.au, which helps protect other people from the same message. There is genuinely no need to feel embarrassed, because these messages are deliberately designed to be convincing, and even careful people are sometimes caught out. What matters now is acting quickly and methodically to secure anything that may be affected, rather than dwelling on how it happened.