How to check a suspicious message from a bank or government agency, and what to do if you have already shared details

Your phone beeps in the middle of the working day: a parcel awaits payment, your account is about to be blocked or unusual activity has been detected in a government service. The message asks for a quick action and includes a link. Instead of judging it by the logo or wording, open the official app or familiar website yourself and check whether the request appears there.

That is the most useful starting point. You do not need to be a cybersecurity expert to separate receiving a message from carrying out the action it proposes. If the request is genuine, you can check it through an official channel. If you have already shared details, act quickly according to the information exposed, without assuming every click is a hack or that closing the window has solved everything.

Check the request, not just its appearance

Phishing is an attempt to get you to disclose information or take an action through impersonation. The Bank of Israel warns about approaches impersonating banks, credit card companies, the Bank of Israel and the police, sometimes using intimidation to obtain confidential details. The first question is therefore what they want you to do: provide a password, read out a code, pay or grant access to a device.

Requests to act immediately, keep the conversation secret or ignore an on-screen warning heighten suspicion. But a calm, polite approach can also be fraudulent. Do not make spelling mistakes a prerequisite for identifying fraud: correct Hebrew does not prove a message's source, and a familiar logo does not authenticate whoever displays it.

Even genuine context is not enough. If you are expecting a parcel, a shipping message may seem plausible. Check the order with the business you bought from or through a delivery service you accessed independently. Do not infer that a link relates to your parcel simply because you are expecting one.

The National Insurance Institute has issued an official warning about messages impersonating unusual-activity alerts. This does not mean every message from National Insurance is fake, but that even a public body's name requires a source check. If unsure, use the contact details on its official website, not a number appearing only in the suspicious message.

Leave the message and verify through a separate channel

The Israel National Cyber Directorate recommends verifying any approach whose identity is uncertain through a parallel channel. In practice, open the banking app already installed on your device, use a familiar website bookmark or type an address you know is correct. For a phone call, use a number on an official document, in the app or on a website you reached separately.

A web search can help you find the organization, but the first result is not necessarily the right channel. Check the destination address and the service's identity before entering information. If you cannot confidently identify the website, use the familiar app or a document you already have. There is no need to open the suspicious link to "see where it goes."

During a call, ask for an explanation of the issue without disclosing a password or code you received. The Bank of Israel stresses that confidential authentication credentials, including a personal code sent by text message, must not be given to someone who contacts you. Read the wording accompanying a code, too: payment approval or account login does not become a security check simply because the caller calls it one.

If a payment request looks urgent, check through an official channel whether it exists, the amount and the deadline. The purpose of pausing is to investigate, not to ignore a genuine debt. A valid request can be dealt with once you have reached the right organization independently.

Steps to take when a suspicious message arrives

• Stop before opening the link, downloading a file or sharing information. If you have started a call or begun filling in a form, do not continue just because you have already invested time in it.
• Save a screenshot of the message, sender name and date, without posting it in a public group. If an address is displayed, record it as shown without visiting it.
• Access the official service independently or call a known number. Ask whether the request exists and what action, if any, is required.
• If you shared information, record exactly what: a password, card details, ID number, code or permission. Do not put the password itself or active codes in your record.
• Contact the organization to which the information relates through its official channel. For banking information or a suspicious payment, ask the bank's or credit card company's security department or fraud helpline for urgent assistance.
• Report the incident to the Israel National Cyber Directorate and take the protective steps appropriate to the case. Keep reference numbers and continue monitoring the relevant accounts for unusual activity.

You can call 119 or use the Israel National Cyber Directorate's cyber incident reporting service. The service is also intended for members of the public and accepts reports of phishing and impersonation for an initial professional response. Contacting it does not replace reporting directly to the bank when money or exposed payment credentials may be at risk.

Already clicked or shared details? Distinguish between situations

Opening a link, entering a password and installing software are different actions. If you only opened a page, stop interacting with it and record what happened. Check whether a file was downloaded or you approved any action. Clicking alone does not prove a breach, but if you are unsure what happened, seek professional guidance rather than carrying out a random reset or ignoring the incident.

If you entered a password, access the genuine account from a device you trust and change it. If that password is used for other services, change it there too. Google's guidance for a compromised account emphasizes checking security events, connected devices and account settings. Also check that recovery details still belong to you and remove access you do not recognize, following the service's instructions.

If you supplied card details or approved a financial action, contact the bank or credit card company immediately. Explain what you entered, what you approved and when, and ask for instructions on blocking access and investigating transactions. Do not wait for a final charge to appear or assume the money will necessarily be refunded. This is general account-protection information, not personal financial or legal advice.

If you installed an app or granted remote access, end contact with the person who approached you and use another trusted device to seek help. State explicitly what was installed and which permissions were granted. Do not carry out further banking activity on the suspect device before receiving appropriate guidance.

If the approach reached a work account or you used an organizational device, also notify the person responsible for information security at work. Describe what you did and do not try to conceal it by deleting correspondence. Your organization may have a procedure to follow, and its team can guide you on preserving evidence and further use of the device. When attaching a screenshot, send it through the channel designated by the organization, without distributing customer or colleague information in a group unrelated to handling the incident.

Prepare your accounts and family in advance

The Israel National Cyber Directorate's account-security guidance recommends a strong, unique password for each account. Exposure of a password in one service then does not automatically provide the same route into all the others. You can use a reputable password manager and learn in advance how to recover access if your phone is lost.

Enable additional authentication in services that offer it, following their instructions. It adds protection, but an authentication code remains a secret: do not pass it to someone who contacts you. Keep software updated and recovery details accessible, too. An account that is well protected but cannot be recovered may leave you without a convenient way to resolve a problem.

Families can agree on a simple rule: an unusual request to transfer money is checked by calling a number already saved in your contacts. If a message comes from someone you know, verify it through another channel before acting. The rule is especially useful when the message urges haste and explains why "I can't talk right now."

Make help easy to ask for. Agree on whom to contact without being scolded, and save official contact details for the bank and important services together. A brief joint check is better than a family member hiding a mistake out of fear of an angry reaction.

Common mistakes after spotting an impersonation attempt

Do not forward a suspicious link to a family group without context, or publish screenshots containing codes and personal details. To warn others, share a description or an image with sensitive information removed that does not invite people to click.

Do not respond to someone promising to recover money or an account in exchange for an upfront fee after the incident. Check every offer of help in the same way as the original approach. The urgency felt after a mistake can lead to another unchecked decision.

Above all, do not wait for complete certainty before reporting to the relevant organization. State precisely what is known and what is not: a link was opened, a password was shared or an action was approved. That information allows a response to begin without guessing whether "the whole phone has been hacked."