Online Safety

Phishing: Fake Links and Messages Designed to Steal Your Info

Updated 2026-08-11

Phishing is when a scammer sends you a fake message or link designed to look like it's from a bank, mobile network, employer, or well-known company. The goal is to trick you into typing in your password, PIN, or personal details on a fake website.

Where phishing shows up

  • SMS: a text claiming to be from your bank or network with a link to "verify your account" or "unlock your SIM."
  • WhatsApp: forwarded messages with links to fake giveaways, fake job offers, or messages that appear to come from a contact whose account was itself hacked.
  • Email: messages that look like they're from a real company, often with logos copied from the real site, asking you to "confirm" your details.
  • Fake websites: pages that closely copy the look of a real bank or mobile money login page, waiting for you to type your password or PIN.

How to spot a phishing link

  • Check the actual web address, not just the link text. A link that displays as mtnuganda.com might actually lead somewhere completely different. Hold your finger on the link (long-press) before tapping to preview where it really goes, or check the address bar carefully once a page loads.
  • Look for small misspellings or extra words in domain names, like mtn-uganda-verify.com or airtelmoney-secure.net instead of the real, official domain.
  • Be suspicious of urgency. "Your account will be closed in 24 hours," "Verify now or lose access." Phishing relies on panic to stop you from thinking carefully.
  • Real organizations don't ask you to confirm your PIN, password, or full card number by clicking a link. If in doubt, don't click. Go directly to the official app or website yourself, or call the organization's official number.
  • A padlock icon or "https" doesn't guarantee a site is genuine. Scammers can get these too. It only means the connection is encrypted, not that the site is trustworthy.

Before you click any link, ask yourself

  1. Was I expecting this message?
  2. Does the web address exactly match the real company's official domain?
  3. Is the message pressuring me to act immediately?
  4. Am I being asked for a password, PIN, or OTP?

If any answer feels off, don't click. Visit the organization's official app or website directly instead, or use the Suspicious Link Checker tool on this site before opening anything you're unsure about.

If you've already clicked a phishing link and entered details

  1. Change the affected password or PIN immediately from a trusted device.
  2. Check your account and mobile money statements for any unauthorized activity.
  3. Enable two-factor authentication (2FA) where available.
  4. Report the phishing message so others can be warned.