How to Recognize a Phishing Message: Signs and Safe Checks
Phishing works because it looks routine and makes you hurry. Here is what to look for and what to do instead of tapping.
Published September 30, 2026 · 2 min read
Key takeaways
- Urgency plus a link plus a request to log in or confirm is the classic phishing pattern.
- No genuine service asks for your password or one-time code by message.
- Check a link's real destination before tapping, because an address can look official without being so.
- When in doubt, ignore the link and go to the service through its known official entry point.
What are the main signs of a phishing message?
Phishing messages try to make you act before you think. They usually combine a few elements, and the more of them you see together, the higher the risk.
- Urgency: a deadline, a threat of blocking, or a claim that something must be confirmed now.
- A link that leads to a page asking you to log in or confirm something.
- A request for a password or a one-time code.
The page behind the link is fake, and whatever you type into it goes to the sender.
Why does a real service never ask for a password or one-time code?
A genuine service never needs your password or one-time code from you. You enter them yourself, on its own login screen, to prove who you are. If a message asks you to send or read them out, the sender is trying to get in as you. Treat this request alone as enough reason to stop, even if the rest of the message looks convincing.
How can I check where a link really leads?
Before tapping, hover over the link, or press and hold it on a phone, to see its real destination. An address that only looks official can differ from the real one by a character or an extra word. If the destination is not exactly what you expect, do not open it. The table below pairs each warning sign with a sensible response.
| Sign | What it looks like | What to do |
|---|---|---|
| Urgency | A deadline or a threat that pushes you to act right now | Pause; urgency is a pressure tactic, not proof of a real problem |
| Link to log in | A button or address leading to a page asking you to sign in or confirm | Check the real destination, or skip the link and use the official entry point |
| Request for password or code | A message asking you to reply with or enter a secret | Never share it; a genuine service does not need it from you |
| Look-alike address | A web address that seems official at a glance | Inspect the full address carefully before tapping, and do not open it if unsure |
What should I do if I'm not sure a message is real?
Do not use the link in the message. Reach the service through its known official entry point: a saved bookmark, the app you installed earlier, or the chat you opened yourself. For Nexus Pay, that means the wallet you opened in Telegram through the bot @nexuspaymybot, not a link that arrived in a message. If the message was genuine, the same notice or task will be waiting there.
Why is phishing especially costly with crypto?
Blockchain transfers are irreversible: nobody can bring back a transfer sent to the wrong address. If a fake page persuades you to send funds or reveal access details, there is usually no way to undo the result. That makes the checking habit more important than any after-the-fact fix. Nexus Pay offers an optional four-digit access code and lets you freeze the card in one tap, but these are extra layers, not a substitute for spotting the trap.
What if I already tapped the link or entered my data?
Stop and do not enter anything more on that page. Then go to the real service through its official entry point rather than through the message, and change any password you typed into the fake page. If you use a card, freezing it while you sort things out limits further use. Anything sent by blockchain transfer cannot be reversed, so act quickly on the parts you can still control.
Common questions
Can a phishing message come from a contact I know?
The topic facts only cover the message itself, not its sender. Judge it by content: urgency, a link, and a request to log in or confirm are warning signs whoever it appears to come from.
Is it safe to open a link just to look?
It is safer to check the real destination first and not open anything you doubt. If you are unsure, use the service's official entry point instead.
Does a professional look prove a message is genuine?
No. A fake page can look official, and an address can look right while leading elsewhere. Check the link's real destination rather than trusting appearance.
Would Nexus Pay ever need my password or one-time code in a message?
A genuine service does not ask for a password or one-time code by message, because it never needs them from you. Treat any such request as suspicious, whoever it claims to be from.
What is the simplest habit that protects me?
Do not act through the message's link. Open the service through its known official entry point and check whether the request exists there.
Related reading
Why you should never tell anyone your verification codeA verification code proves you are you, so whoever has it can act as you. Here is why no one legitimate asks for it, and what to do if you already shared one.
How to Tell a Real Website from a Fake CopyCheck the address character by character, use a saved official entry point, and never enter a seed phrase or login code on a page. Here is how to spot a fake.
Common Crypto Scams to Avoid When Funding Your Wallet or CardCommon crypto scams target wallet and card users. Learn to spot fake verification requests, phishing sites, and address-swapping tricks before you send funds.
How to Tell Real Support from a Scammer Posing as SupportFake support often writes first and asks for codes or a 'verification' transfer. Learn the warning signs and how to reach real help safely, step by step.