Malware and phishing: prevention and proportionate response

Phishing is an attempt to trick you: a message, call or page that wants you to follow a link, install something, or hand over a password or confirmation code. Malware is unwanted software that runs on a device. The two are not always the same. Many deceptive messages only want you to sign in and never install a program on the phone. Some malware also arrives without that classic message, from a file or an unofficial app.

The response should match what actually happened. Typing a password on a fake page belongs more with the guide to recovering a compromised account. Opening a file or installing an unknown app is a different story. Everyday browsing habits are covered separately in safer web browsing. This page focuses on recognising patterns, day-to-day prevention, and what to do after a mistake.

Why you should not treat them as one thing

If you call everything a “hack”, you either panic more than you need to or you downplay a real sign. An urgent bank message with a short link may be phishing only. A Word file from an unknown address that asks you to enable macros is a malware path. An app installed from outside the store that asks for accessibility access is another kind of risk.

Proportionality means asking first what you actually did: you only looked, you followed a link, you typed something, you opened a file, or an app was installed. Each of those has its own set of steps. A full phone reset is usually unnecessary for a link that opened and asked for nothing. Changing one password while a suspicious app is still on the device is not enough either.

Common phishing patterns

A deceptive message often arrives with urgency: an account will be closed, a parcel is stuck in customs, a prize is waiting, or a manager wants a file right now. The aim is to make you act before you think. A familiar look is part of the same design: a logo, a sender name and even a link preview may resemble the real service.

• A message that pushes you to “sign in again” to stop a service being cut off.
• An invoice, parcel receipt or “complaint” file that you must download to see the details.
• A message inside an app you already use, for example a work chat, from someone whose name you know but whose tone or request is unusual.
• A sign-in page whose address differs from the real site by only a character or two.
• A support call or message that asks you to read out a confirmation code or a sign-in screen.

If the matter is important, go to that service the way you already know: open the official app from your app drawer, not from the message link. Contact the sender on another channel and ask whether they sent that request.

Read the address, not only the title and logo

The lock next to the address only says the connection to the address in the bar is encrypted, not that the address belongs to the company you have in mind. A fake page can have a certificate too. What you need to read is the domain name itself.

1. On a computer, hover over the link and look at the destination in the status bar; on a phone, press and hold the link until an address preview appears.
2. Read the main part of the domain, not the long path after it. A brand name appearing inside the path does not make the domain official.
3. Watch for look-alike characters, an extra hyphen and an unexpected suffix.
4. If you are unsure, type the address from memory or from your own address book into the browser bar.
5. Do not open short codes or “open in app” buttons that arrived in a text from someone you do not know.

Attachments, cloud documents and macros

A lot of everyday malware still arrives through files: an office document, an archive, a fake installer, or a link that looks like a cloud document and then asks for access to your mail or drive after you sign in. If you were not expecting that file, there is no reason to rush to open it.

1. Confirm the sender somewhere other than that same message, especially if the file is password-protected and the password is written in the same message; that combination is common.
2. Look at the file type. An installer, a script or a macro-enabled document is odd for a “simple invoice”.
3. If an office app asks you to enable active content or macros and you did not request that feature yourself, do not enable it.
4. Refuse cloud documents that ask for access to the whole account unless you created that share yourself.
5. Do not open a suspicious file on your main computer “just to see what it is”.

Unofficial apps and dangerous permissions

Installing from outside the official store, turning on unknown sources, and granting permissions such as full accessibility access or installs from unknown sources are a classic malware path on phones. A fake banking app or “virus cleaner” can also appear inside the store itself under a name close to the real one.

1. Get the app from the official store for that device and match the developer name with one you already know.
2. If an app wants accessibility access, permission to draw over other apps, or the right to read all notifications for a simple job, do not accept the reason unless you know exactly why it is needed.
3. Do not leave unknown sources or sideloading turned on. If you turned them on for one temporary task, turn them off again in the same place after the install.
4. Do not install an “optimizer”, “cleaner theme” or unknown antivirus from an advert inside the browser.

QR codes, cables and support calls

Deception is not limited to the inbox. A QR code on a sticker or in a message can lead to the same fake page. An unknown cable or charger in a public place may give the device more than power. A caller who claims to be bank or software-store support may want to watch your screen remotely or hear a code that was meant for you.

1. Open a code when you saw it yourself on official paper or inside an app you already trust, not on a notice stuck to an ATM or in a promotional message.
2. For charging while you travel, use your own adapter and, if you can, a data-blocking adapter; do not plug a dedicated cable into an unknown kiosk unless you have to.
3. Never read a confirmation code, passphrase or sign-in screen to someone who called you. Real support will not ask for those on a first call.
4. If someone installed a remote-access app for you, or asked you to install one you did not request, cut the connection at once.

Keep software updated from official paths

A great deal of commodity malware still arrives through holes whose patches have already been published. Updates are tedious, but they do more than most “cleaner” tools.

1. Update the phone and computer operating systems from that device’s official settings, not from a file that arrived in a message.
2. Give priority to the browser and to the apps you use to sign in to accounts.
3. If a tool is no longer updated and its maker has abandoned it, find a replacement.
4. Treat browser extensions like apps: keep them few and install them only from that browser’s official store.

Android: Play Protect and a look at your apps

1. Go to Settings > Security and privacy > App security and leave Google Play Protect on.
2. Run a Scan once and take its warnings seriously.
3. In the same security area, see which apps are allowed to install from unknown sources and remove any permission you do not need.
4. Review the app list and remove anything you do not recognise or did not install yourself.
5. For banking and messaging apps, review notifications and access to the camera, microphone and location separately.

If a Samsung phone or another maker offers an extra official security layer, look at that from its official settings path. You do not need a third-party tool advertised as something that “makes the phone like new”.

iPhone and unknown profiles

On an iPhone, installing malware is harder for an ordinary user, but a device-management profile, an unknown certificate or an enterprise app can open a path to more control. If you do not belong to an organisation that should place such a profile, its presence is a question mark.

1. Go to Settings > General > VPN & Device Management.
2. If you see a profile or management entry you do not recognise, remove it, and if you cannot remove it, get help through that device’s official support path.
3. Install apps from the App Store and do not trust an invitation to install from an unknown link.
4. Update the system from Settings > General > Software Update.

Windows and the system’s own warnings

1. Go to Settings > Privacy & security > Windows Security.
2. In Virus & threat protection run a scan and check that definitions are up to date.
3. Do not bypass a SmartScreen warning about running an unknown file unless you have confirmed the source another way.
4. Review installed apps under Settings > Apps and remove anything new that you do not recognise.
5. Show file extensions in File Explorer so that “invoice.pdf.exe” cannot hide behind a document icon.

If you only followed a link and typed nothing

Opening a page by itself does not always mean the device is infected. Many fake pages are simply waiting for you to type.

1. Close the page and do not go back to the same link “to see if it is still there”.
2. If the browser showed a warning, do not ignore it.
3. Check whether the page asked for notification, location or a file download. If nuisance notifications started, remove that site’s notification permission in the browser settings.
4. Do not change passwords on the spot unless you typed something; rushed changes make it easy to lose track of accounts. If you are unsure whether you typed anything, review that account from a device you trust.

If you entered a password, code or payment details

This is closer to account takeover than to installing malware, unless the same page also offered a file.

1. From a device you trust, go to that service on its official path, not through the message link.
2. Change the password, sign out other sessions and review recovery methods. The account-recovery guide covers the details.
3. If you read out a confirmation code, assume someone signed in at that moment.
4. If you gave card details, contact the bank from the number on the back of the card or from the official app, not from a number in that same message.
5. Tell people who might receive a fake message in your name, especially if a messaging account was involved.

If you opened a file or an app was installed

1. Do not leave the device on a work network or signed in to sensitive accounts. If you can, disconnect from the network for a while so the program has less chance to send data or take further instructions.
2. Remove that app or extension. On Android use the app settings; on Windows use the app list.
3. Run the official scan for that system: Play Protect, Windows Security or the Mac equivalent.
4. From a healthy device, change the passwords of accounts that were open on the suspicious device and sign out their sessions.
5. If the app had taken accessibility access, device-admin rights or the ability to install apps, check those same permissions again after removal so nothing is left behind.
6. When doubt is serious or you cannot remove the tool, restore personal files from a backup taken before the incident and reset or reinstall the system. Get apps again from the official store, not from inside that suspicious backup.

When a reset is proportionate

A factory reset or a fresh system install is a heavy tool. You do not need it for a phishing message where you only saw a page. It makes more sense when an unknown app with high privileges was installed, when the device’s behaviour has clearly changed, or when you cannot find and remove the source.

1. Before you reset, if you still trust your personal files, copy them to separate media. Do not restore a full device backup that may have been taken after the infection as if it were clean.
2. Reset from that device’s official settings.
3. Sign in to accounts one by one and install only the apps you need, from official paths.
4. After you are back, set the screen lock, updates and a fresh backup again.

When the worry is targeted spyware

Most people face commodity phishing and unwanted apps, not expensive targeted tools. If your work or activity puts you at serious risk, though, or you see signs such as very unusual battery, data and heat alongside highly personalised messages, the response should be more careful.

1. Do not hand the device to an unknown repair shop or to someone you do not know “to clean it”.
2. Do not install unknown “anti-spyware” apps sent to you in a message; some of them are a problem themselves.
3. Harden your main accounts from another device.
4. For a specialist examination, go to a source you chose yourself, not a link that arrived in the same suspicious message.
5. At that level, replacing the device and not doing a full restore from a suspicious copy is sometimes the only reliable option. Do not take that decision for every advertising alert; match it to the signs and the context.

What to tell other people after an incident

If your mail or messenger account was used, your contacts may get a deceptive message too. A short, specific note is better than staying silent out of embarrassment. You do not need unnecessary detail; it is enough to say that if a message with that content arrives from you, they should not follow its link. If this happened at work, report it through that workplace’s process so other people do not open the same file.

Common mistakes

• Clicking out of curiosity “just to see what it is”.
• Bypassing a browser or system warning because the file “looked like it came from a colleague”.
• Installing a fake antivirus after a frightening notice on a web page.
• Changing a password on the same device that still has a suspicious app, and stopping there.
• Sending a confirmation code to someone who claims to be support.
• Doing a full reset for every promotional text — or, at the other extreme, ignoring an unknown app that was just installed.

Treat a confirmation code like a password

Many current scams are no longer after the password itself. They want you to sign in and read them a one-time code, or to approve a prompt on the phone. If someone has already obtained the password another way, that code is the way in.

1. Do not send a code to anyone, even if the number or name looks official.
2. If you were not signing in yourself and an approval request appeared, reject it and review sessions on the official path.
3. Move two-step verification from SMS to an authenticator app or a security key so that stealing the number is less useful; that is covered in another guide in this set.
4. Take a “new sign-in to your account” message seriously. If it was not you, change the password from a healthy device at once.

Browser notifications, download buttons and scare pages

Some sites ask for notification permission after one click and then show constant virus alerts. Other pages put a fake download button next to the real one, or open a window that looks like the operating system and says the device is infected and you should call a number.

1. Do not allow notifications from a site you have only just seen. If you already did, remove that address’s notification permission in the browser settings.
2. Do not download an app from a button in the middle of an unknown page; go to that maker’s official site or store.
3. A full-screen window that looks like Windows or Android and will not close is a warning sign. Quit the browser entirely; do not call that number and do not tap a “clean up” button on that same page.
4. Do not install an unknown extension offered as a way to “stop these notifications”.

The display name is not the real address

In email, the display name can be set to almost anything. What you should read is the sender’s real address, and even that is not always enough, because a real account belonging to someone you know may have been taken over. If the request is unusual, ask on another channel you already have. In text messages, a sender name or prefix can also look forged; opening the official bank app on your own phone is safer than following a link in a text.

Messages that look like they come from the post, a court, the tax office or a parcel service are common. Formal language and legal threats do not, by themselves, make a message genuine. If that organisation really needs something from you, it usually has an independent way to follow up, which you can find from its own website or a number you already have on record.

Shared devices and work files

On a shared computer or a café machine, signing in to a main account and opening a suspicious file both raise the risk. If you have to work on someone else’s device, do not sign in to sensitive accounts, do not open unknown files, and sign out when you finish. It is better to look at a suspicious work file somewhere separate from the computer where personal mail and banking are open — or at least not to open it until the sender is confirmed.

What official tools cannot do

Play Protect, Windows Security and browser warnings stop many known apps and sites, but something new that they have not yet catalogued may still get through. These tools do not replace thinking before you click. On the other side, a frightening message that appears inside an unknown site and says “214 viruses found” is usually that site’s own notice, not a report from your system security.

If an official scan finds something, follow the removal or quarantine suggestion from that same system page. If the scan finds nothing but you did run a file and the device’s behaviour has changed, do not treat the lack of a warning as proof of health; removing the app and, if needed, resetting are still on the table.

After you clean up, close the path

Removing an app or changing a password is only the start of closing the incident. Check that the same account has no open sessions on other devices, that mail forwarding was not turned on, and that an unknown app was not added as a sign-in method. If you took a device backup right after the incident, do not use it as a full restore source. Personal files can be brought back separately; install apps again from official paths.

What to do from today

1. Before you act on an urgent message, open that service yourself on its official path.
2. Update the system and the browser from official settings.
3. Review Play Protect or Windows Security once and run a scan.
4. Remove apps and extensions you do not recognise, and turn off installs from unknown sources.
5. If you typed something or something was installed, match the response to that event: the account, the device, or both.