What is phishing?
Phishing is when someone pretends to be a trusted person or organisation — your bank, a delivery company, even a colleague — to trick you into giving them passwords, money, or personal information.
The 7 Red Flags: How to Spot a Scam Before You Click
1. The sender's email looks wrong
Scammers use addresses that look almost right: support@paypaI.com (capital I instead of lowercase L), info@zanaco-secure.com (extra words), orno-reply@whatsapp.co (wrong domain). Hover over the address to see the real one.
2. Urgent or threatening language
"Your account will be closed in 24 hours." "Unauthorised login detected — verify now." "You have won a prize — claim within 2 hours." Scammers create panic so you act without thinking. Real organisations do not pressure you like this.
3. Generic greetings
"Dear Customer," "Dear User," "Hello Sir/Madam." Real companies that have your account use your name. Scammers send the same message to thousands of people.
4. Suspicious links
The text says "Click here to verify your ZANACO account" but the link goes tozanaco-verify-now.biz. Hover over any link before clicking — the real destination appears at the bottom of your browser. A mismatch is the single most reliable sign of a phishing attempt.
5. Requests for personal information
No legitimate organisation will ask for your password, PIN, or full banking details by email, SMS, or phone. If someone asks, it is a scam — period.
Scams You Are Likely to Encounter in Zambia
- Fake mobile money messages. "You have received K5,000 from [name]. Click to confirm." The link goes to a fake site that steals your mobile money PIN.
- Fake job offers. "We saw your CV. You have been selected for a position at [company]. Pay K500 for processing." Real employers never ask you to pay for a job.
- WhatsApp account takeover. You receive a verification code you did not request, followed by a message from a "friend" urgently asking for that code. They are trying to hijack your WhatsApp.
- Fake ZRA or government messages. "Your tax refund of K3,200 is ready. Submit your details to claim." Government agencies do not request personal information via SMS.
- Social media impersonation. A profile pretending to be a celebrity, company, or public figure messages you with an "opportunity." Check for a verified badge. Check the follower count. If in doubt, ignore.
What to Do If You Suspect a Phishing Attempt
- Do not click anything. Not the link, not the attachment, not the image.
- Do not reply. Engaging confirms your email is active and leads to more scams.
- Verify through a separate channel. Got an "urgent" message from your bank? Call the number on their official website — not the one in the message.
- Report it. Most email providers and messaging apps have a "Report Phishing" or "Report Spam" button. Use it — it protects others too.
What If You Already Clicked?
- Disconnect from the internet immediately.
- Change the password for the affected account, using a different device if possible.
- Turn on two-factor authentication for that account.
- If you entered banking or payment information, contact your bank immediately.
- Scan your device with antivirus software (Windows Defender or Malwarebytes).
- Check for unfamiliar logins in your account's security settings.