If you have already entered card details, a password or a verification code, act according to what you shared without waiting for another suspicious charge. Contact your bank or card issuer through a channel you found independently, secure the account and use the Israel National Cyber Directorate's 119 hotline, which operates around the clock. These instructions were checked on October 16, 2026, and do not guarantee that every click caused harm or that every amount will be refunded.
Check the Request First, Then the Message's Appearance
Phishing is an attempt to make someone provide information or take action through impersonation. In consumer messages, the request may look routine: update an address, confirm a login, settle a payment or prevent a parcel from being returned. A short text is especially convenient for this tactic because it provides little context and pushes toward one action.
The first check is what exactly they want from you. A request for card details, a password or a one-time code following an unsolicited message calls for a pause. A threat of deletion or an extra charge is no reason to skip checking. The more someone pressures you not to consult anyone or contact customer service, the more important it is to leave the conversation and verify independently.
For illustration only, a fictional message without a link: "Your parcel is waiting. Update your payment method to prevent its return." You do not need to know who sent it to choose a safe action: do not enter details through the message; check the order where you placed it. This example is not a report about a particular company or a real text message.
What an Address Can Tell You, and What It Cannot
An address that does not match the official site, a misspelling of the service's name or a chain of redirects are warning signs. Apple's guidance on identifying impersonation also recommends not sharing information in response to a suspicious approach and contacting the company using known contact details. Your browser does not need to become a testing laboratory for the link you received.
A brand name appearing within a long address does not prove it is that brand's website. The same goes for a padlock or HTTPS: neither confirms the business's identity or the operator's honesty. You can avoid the technical judgment altogether by opening an app already installed on your device independently or typing a known official address.
Correct language is no certificate of trustworthiness, and a spelling mistake is not the sole proof of fraud. It is better to check whether the requested action also appears in your account and whether transaction details match. There is no need to call the number in the message to "verify": it may be part of the same impersonation attempt.
Even a Personalized Message Can Be Impersonation
On December 28, 2025, the Israel National Cyber Directorate warned about targeted phishing attempts posing as messages from familiar parties and distributed through communication apps. For consumers, this means a personal detail in a message is not enough to validate it. An approach that knows your name still needs independent checking.
On September 1, 2026, the Israel Tax Authority published public guidance titled "Received a Message From the Tax Authority? Do Not Click Before Checking Its Source." It also includes steps for people who already entered details. This is a documented example that impersonation is not limited to parcels or shops, not a reason to conclude that every message from a public authority is fake.
WhatsApp has another simple trap: knowing the account owner does not prove they are the person now requesting a code or money transfer. If the request is unusual, call through a contact method you already had saved. A request to forward a code sent to your phone does not become safe because it appears in an old conversation.
Did You Only Click, or Did You Also Share Something?
Distinguish between situations. If you opened a page but did not enter details, download a file or approve an installation or permission, close it and do not continue. The click alone is not proof that an account was compromised, but it also does not allow a guarantee that nothing happened. If there was a download, unusual alert or uncertainty about what was approved, seek guidance.
If you shared a password, enter the real service through a known address or app and change it. If the same password is used elsewhere, change it there too. Check recovery details, connected devices and account activity where supported, and disconnect sessions you do not recognize. Enable two-step verification through the official settings, not through the person who contacted you.
If an app was installed following the message, remote control was granted or a bank verification code was shared, this is no longer just a matter of deleting a text. Where possible, use another trusted device to contact the bank and cyber hotline. Describe what was installed and approved, and do not follow further instructions from anyone claiming to be "fixing" the problem.
Payment Details Shared: Contact Whoever Can Stop Their Use
If you entered a card number or approved a financial action, contact the card issuer or bank promptly. Explain whether only card details were entered, whether a one-time code was also shared and whether a transfer occurred. Request instructions for blocking, replacement and transaction investigation as appropriate. Merely changing the password on the impersonation site does not protect an already exposed card.
Keep a screenshot of the message, the time, any charge amount shown and the reference number you received. Do not post images in groups containing a full card number, identity number or verification codes. Documentation is for the organization handling the case, not a forwarding chain that exposes personal information again.
Not every unfamiliar charge is necessarily fraud, and not every authorized payment will automatically be refunded. Card issuers also distinguish between a transaction not made by the customer and a dispute with a supplier. If this was a genuine purchase whose product was not supplied, also consult the guide to canceling an online purchase. An accurate account of the event helps the process more than a general claim that "I was scammed."
Report Without Spreading the Message Further
The Israel National Cyber Directorate operates the 119 hotline and also publishes the reporting email address [email protected] and online forms. Reporting can help with guidance and handling the threat, but it does not replace contacting the card issuer when money or payment details are involved, or a police complaint when required.
Official channels can be found through the cyber incident reporting service. Prefer reaching it yourself rather than through someone presenting themselves as a hotline caller. Do not give a verification code to someone merely because the displayed phone number looks familiar.
When warning family members, share the explanation and the method for checking independently. There is no need to forward the suspicious link as an active link. A screenshot with personal details hidden is sometimes enough to demonstrate the method without creating another opportunity to click.
Phone Filtering Helps but Does Not Replace Judgment
Apple's documentation includes options for filtering messages from unknown senders. Google Messages allows conversations to be blocked and reported as spam. Menu names and options vary by version, device and messaging app, so rely on the manufacturer's instructions for your device rather than an old screenshot.
A message not blocked by filtering may still be problematic, and a filtered message may be legitimate. Check the filtered folder occasionally to avoid missing a necessary message, but do not treat its placement in a particular folder as proof of trustworthiness. The aim is to reduce clutter, not hand responsibility for a financial decision to the phone.
Business owners should also establish who may approve payments and changes to supplier details, a subject explored in the article on defending Israeli businesses against cyber threats. Families can start with one short rule: when a message requests money or a code, do not continue from the message. Switch to a familiar channel and check.
More guides in the Internet section.
