Written by Roy Morken, IT adviser and co-founder of Datafolka. Published 26 June 2026, last updated 23 September 2026

What Is Phishing? How to Spot Scams and Fake Emails

Received a suspicious email and not sure if it's real? In 2026, fraudsters use AI-generated text and perfect copies of bank websites to trick you. But there are 7 clear warning signs that identify fake emails. Here you'll learn how to spot phishing, what to do if you've clicked a fake link, and how to report fraud attempts.

What is phishing?

Phishing is fraud where someone poses as a bank, a government agency, a supplier or a colleague to get you to click a link or hand over passwords and BankID codes. The name is a play on "fishing": the scammer casts bait at a lot of people and waits for someone to bite. It usually arrives by email, but also by SMS (smishing), phone call (vishing) and social media messages.

These attacks have become far more sophisticated in recent years. Fraudsters use real logos, copy designs from well-known websites, and write increasingly convincing text. Fortunately, there are clear signs that expose fake emails - even the most convincing ones.

7 signs that an email is phishing

1. Wrong sender address

Always look at the actual email address, not just the display name. An email from "Bank Customer Service" that actually comes from "support@bank-security-123.com" is definitely fraud. Legitimate companies send from their own domain.

2. Urgent language

"Your account will be closed in 24 hours!" or "Pay immediately to avoid debt collection." Fraudsters use time pressure to stop you from thinking things through. Legitimate companies never send such threats by email without prior notice.

3. Suspicious links

Hover over links without clicking. Look at the URL that appears. Does it point somewhere other than the company's official website? That's a scam. Watch for misspellings in the domain: "amazon-support.com" is not the same as "amazon.com".

4. Language errors and poor formatting

Even though phishing emails have improved, odd phrasing, missing letters, and inconsistent formatting are still common. Compare with genuine emails you've previously received from the same sender.

5. Requests for sensitive information

Your bank will never ask for your password, login codes, or account number by email. The same applies to tax authorities, postal services, and all other reputable organisations.

6. Unexpected attachment

Files with extensions like .exe, .zip, .scr, or .js should never be opened unless you are completely certain who sent them. Even PDF files can contain malicious code in some cases.

7. Generic greeting

"Dear customer" instead of your name is a warning sign. Companies you have a relationship with usually know your name. It's not a definitive sign on its own, but combined with other indicators it strengthens the suspicion.

Common phishing examples in Norway

The wording changes, but a handful of scripts come back year after year:

• A parcel is waiting: an SMS saying a parcel is stuck and you need to pay a small fee through a link. The link leads to a fake payment page that steals your card number.
• Tax refund: an email that looks like it comes from the Norwegian Tax Administration (Skatteetaten), linking to a page that asks for BankID. Skatteetaten does not send links like that.
• Fake bank employee on the phone: someone calls, says your account is under attack and asks you to confirm with BankID to "secure" the money. In reality you approve a transfer.
• Invoice with a new account number: a supplier you know "has changed banks". The email comes from a look-alike address, or from the supplier's real account after it has been taken over.
• The boss needs help now: a message from the "CEO" asking finance to pay something quickly and quietly. Always call back on a number you already have.

SMS fraud (smishing)

SMS fraud follows the same pattern as email phishing. Fake parcel deliveries, "suspicious activity" on your account, or prizes you've "won". Postal services never send SMS messages with links to payment pages. Banks never ask for login codes via SMS.

Always verify the sender. If you're unsure, go directly to the company's website by typing the address yourself in the browser. Do not click the link in the message. Fake emails and SMS messages use the same tricks.

Scammers move to where people are least on guard. Verizon's 2026 Data Breach Investigations Report found that fake text messages and voice calls succeed 40 percent more often than traditional email phishing. On a phone you don't see the full sender address, and it is harder to check where a link goes.

What to do if you clicked

If you clicked a phishing link or provided information, it's important to act quickly:

• Change your password immediately on the affected account and on any other accounts where you use the same password.
• Call your bank right away if you provided banking details or login codes.
• Run a full virus scan on your device.
• Enable two-factor authentication wherever possible.
• Report to the police via the police tip line if you have lost money.

An employee clicked? How the business should respond

At work, the real damage happens when nobody speaks up. A stolen login can be used for days before anyone notices. Make it easy and blame-free to report, and do this straight away:

• Change the password and sign out all active sessions, so an attacker who is already in gets thrown out.
• Check the mailbox for new rules that forward or delete email. That is a common trace of a hijacked Microsoft 365 account.
• Warn customers and suppliers if the account may have sent fake invoices in the company's name.
• Assess whether personal data may have been exposed. If so, it is a breach that must be reported to Datatilsynet within 72 hours.

If you want help with two-factor authentication, email filtering and a plan for what happens when someone clicks, we can cover it through our IT security services.

How to report phishing

Reporting helps stop fraudsters. You can report phishing to several places:

• Forward the email to the company being impersonated (they usually have a dedicated email address for this).
• If you are a business, digital incidents can be reported around the clock to the National Cyber Security Centre at NSM via cert@ncsc.no or 02497.
• Nettvett.no, run by NorSIS, has guidance on recognising phishing (in Norwegian).
• Report in your email client. Both Outlook and Gmail have dedicated buttons for reporting phishing.

Spoofing: When the sender looks genuine

Some fraudsters manage to forge the actual sender address so it looks completely genuine. This is called spoofing. The email can appear to come from your boss, your bank, or a colleague.

The defence against spoofing is to never blindly trust the sender address alone. Does the content look suspicious? Call the sender by phone and ask whether they actually sent it. NorSIS has a good phishing guide with up-to-date examples.

Everyday prevention

The best protection is good habits. Use a password manager so you never reuse passwords. Enable two-factor authentication on all important accounts. Keep your software updated. And take five extra seconds to think critically about emails that ask you to do something.

If you feel uncertain about IT security, IT help from Datafolka can give you guidance tailored to your needs. There are no stupid questions when it comes to online fraud.

Summary

Always check the sender address, be sceptical of urgent language, and hover over links before clicking. If you've given information to fraudsters, change your passwords and contact your bank immediately. The most important thing is to pause and think - which is exactly what fraudsters try to prevent you from doing.

Claude AI helped me with phrasing and proofreading in this article.