Reading is great. Tracking makes it stick. Sign up for a free Dashboard to tick off tasks and see your Security Score.
Get my free Dashboard →Android phishing: how to spot and avoid it
Phishing is one of the most common ways attackers target Android users. It involves tricking you into visiting a fake website or entering personal information through a deceptive message or link. This guide explains how phishing works on Android, how to spot it, and what to do if you have clicked something suspicious.
What phishing looks like on Android
On Android, phishing attempts typically arrive via SMS (called smishing), email, WhatsApp, social media messages, or through push notifications from malicious apps. They are designed to create urgency and make you act before thinking:
- A text message claiming your bank account has been suspended, with a link to "verify" your details
- An email telling you a parcel is being held and asking for a small delivery fee payment
- A WhatsApp message from a "friend" asking you to click a link to a prize they have won for you
- A notification from an app claiming your Google account has been compromised
- A fake login page for HMRC, a bank, or your email provider asking for your username and password
How to spot a phishing attempt
Phishing messages share common characteristics. Train yourself to look for:
- Urgency: "Act immediately", "Your account will be suspended in 24 hours", "One-time offer"
- Suspicious links: hover over or long-press links before tapping to see the actual URL. Does it look right?
- Spelling and grammar: official communications from banks and government agencies are professionally written
- Unexpected contact: your bank will not ask you to verify details via a text message link
- Mismatched domains: "hmrc-refund.co" or "lloydsbank-secure.net" are not official sites
- Requests for personal or financial information via a link you were not expecting
Common UK phishing scenarios
These are the most frequently reported phishing attempts targeting UK users:
- HMRC tax refund or unpaid tax demand: HMRC never contacts you about refunds via text or email link
- Royal Mail parcel holding fee: legitimate Royal Mail notifications do not require payment via a link in a text
- Bank fraud alerts asking you to "confirm" your details on a linked page
- Mobile network account suspension with a link to update payment details
- WhatsApp "Hi Mum/Dad" scams where someone claims to be your child needing money
What to do if you clicked a suspicious link
Act quickly but do not panic: what you do in the next few minutes matters:
- Do not enter any information on the page you were taken to
- Close the browser tab or app immediately
- If you entered any passwords, change them right away on a different device or connection
- If you entered banking details, contact your bank immediately and report potential fraud
- Run a Google Play Protect scan to check your device is clean
- Report phishing texts in the UK by forwarding them to 7726 (spells SPAM on a keypad)
Track your Android security progress. Free.
Create a free account to tick off tasks, see your Security Score improve, and know exactly what you've done and what's still to do.
Start your free security check