How to spot a phishing text, email or link
Phishing is a message that pretends to be your bank, e-wallet, delivery company, employer or a government agency. It wants you to tap a link and type your login, card details or a code. The link leads to a copy of the real website that belongs to the scammer.
The warning signs
- Pressure. “Your account will be closed in 24 hours.” Real companies give you time and several ways to respond.
- A request for a code, PIN or password. No real bank or e-wallet asks you to send these. See OTPs and PINs.
- A link that is almost right.
gcash-verify.topis not GCash. Scammers add words, swap letters (paypa1) or use endings like.top. - A surprise reward or refund. Prizes, “parcel fees” and refunds you did not expect are bait.
- A tone that is slightly off. Generic greetings, odd wording or a number you do not recognize.
- A threat. Arrest, legal action or a blocked SIM. Scammers use fear to stop you from thinking.
How to read a link
The part that matters is the website name just before the first single /. In https://gcash.com.verify-login.top/home, the real site is verify-login.top, not gcash.com, because the name is read from right to left. When a link starts with a brand you know but ends in something else, do not use it.
What to do instead
- Do not tap the link or call the number in the message.
- Open the official app, or type the official website address yourself.
- If you must call, use the number printed on your card or on the company’s official website.
- Still unsure? Paste the message into Huli Ka Check.
If you already tapped or typed something
Change the password of that account right away, contact your bank or e-wallet through its official app or website, and watch your accounts for strange activity. Read what to do right after you’ve been scammed.
Last reviewed 17 Oct 2026.