Every week, people across Uganda receive messages that look like they come from a bank, a mobile money provider, URA, a courier company or even their own boss. Many of them are fake. Learning how to spot phishing emails and messages is one of the most valuable skills you can have, because one careless click can cost you your email account, your Mobile Money balance or your company's data.
This guide explains what phishing is, shows the warning signs with examples you are likely to see in Uganda, and gives you a simple routine to follow whenever a message feels off.
What is phishing?
Phishing is a trick where a criminal pretends to be someone you trust so that you will hand over something valuable. That might be a password, a PIN, a one time code, card details or money. The message usually pushes you to act fast, before you have time to think.
Phishing comes in several forms:
- Email phishing: fake emails that look like they come from a bank, Google, Microsoft, a supplier or a government body.
- Smishing: phishing by SMS, for example a message claiming your MTN or Airtel line will be blocked.
- WhatsApp and social media scams: messages from hijacked accounts of friends asking for urgent money or a verification code.
- Voice phishing (vishing): phone calls from people posing as customer care, bank staff or police.
How to spot phishing emails: the ten warning signs
1. The sender address does not match
The display name might say "Stanbic Bank" or "Microsoft Support", but the actual address is something like support.verify2024@gmail.com or an odd domain with extra letters. Always tap or hover on the sender name to see the full address. A real company email comes from the company's own domain.
2. Urgent or threatening language
Phrases like "your account will be closed in 24 hours", "final warning" or "you have been fined" are designed to panic you. Genuine organisations rarely threaten you by email and almost never demand action within minutes.
3. A request for passwords, PINs or codes
No real bank, mobile money provider or email service will ask you for your PIN or password by email, SMS or phone. If a message asks for one, treat it as a scam, full stop.
4. Links that go somewhere unexpected
Before clicking, hover over the link on a computer or long press it on a phone to preview the address. Watch for lookalike spellings, such as an extra letter or a number in place of a letter, and long strings of random characters. When in doubt, do not click. Type the official website address yourself.
5. Unexpected attachments
An "invoice", "payment receipt" or "delivery document" you were not expecting is a classic trap. Files ending in .zip, .exe, .html, or Office documents that ask you to "enable macros" are especially risky.
6. Generic greetings
"Dear customer" or "Dear user" instead of your name can be a sign of a mass phishing campaign. It is not proof on its own, but combined with other signs it should raise your guard.
7. Spelling mistakes and strange formatting
Many scam messages contain poor grammar, odd capital letters, blurry logos or mismatched fonts. Some are now very polished, though, so do not rely on this sign alone.
8. Too good to be true
You have won a phone in a promotion you never entered, been selected for a scholarship abroad, or offered a job paying in dollars for an hour's work a day. If it sounds too good to be true, it almost certainly is.
9. Payment detail changes
A "supplier" emails to say their bank account or Mobile Money number has changed and asks you to pay the next invoice to the new details. This is a common fraud against businesses. Always confirm by calling the supplier on a number you already have.
10. Requests to keep it secret
A message from "the director" asking an accountant to make an urgent, confidential transfer and not to tell anyone is a well known scam. Secrecy plus urgency is a big red flag.
Phishing examples common in Uganda
Here are some patterns people in Kampala and beyond regularly report:
- An SMS saying "I have sent you money by mistake, please send it back", followed by a call. Always check your actual balance first.
- Fake messages claiming your SIM registration is incomplete and asking you to dial a code or share your ID details.
- Emails pretending to be from URA about a tax refund, linking to a fake login page.
- Messages about a parcel "held at customs" that needs a small fee via Mobile Money before delivery.
- WhatsApp messages from a friend's hacked account asking for the six digit code "sent to you by mistake".
- Fake job adverts asking applicants to pay a registration or medical fee.
What to do when you suspect a phishing message
Follow this simple routine:
- Stop. Do not click links, open attachments or reply.
- Check the sender. Look at the full email address or phone number.
- Verify separately. Contact the organisation or person using a phone number or website you already trust, not the details in the message.
- Report it. Forward suspicious emails to your IT person or email provider, mark them as spam or phishing, and report scam numbers to your network.
- Delete it once reported.
What to do if you already clicked
Do not panic, but act quickly:
- If you entered a password, change it immediately, and change it on any other account that uses the same password.
- Turn on two factor authentication for your email and important accounts.
- If you shared a Mobile Money PIN or bank details, call your provider's customer care straight away and ask them to secure the account.
- If you opened an attachment on a work computer, disconnect from the network and tell your IT support.
- Watch your accounts and statements closely for the next few weeks.
How businesses can reduce phishing risk
For companies, phishing is a team problem, not just an individual one. A few practical steps make a big difference:
- Use a professional business email on your own domain, so staff and customers learn what genuine messages from you look like.
- Make sure your domain has proper email authentication records (SPF, DKIM and DMARC), which make it harder for criminals to send fake email in your name.
- Require a phone call to confirm any change in payment details.
- Train staff with short, regular sessions using real examples.
Baasa Cloud business email comes with spam filtering and we can help set up SPF, DKIM and DMARC on your domain so your messages are trusted and impersonation is harder.
Frequently asked questions
Can I get hacked just by opening a phishing email?
Simply opening an email is usually low risk on an updated device. The danger comes from clicking links, downloading attachments or replying with information. Still, delete suspicious messages rather than exploring them.
How do I know if an SMS from MTN or Airtel is genuine?
Official messages normally come from the network's recognised short codes or sender names, not from ordinary mobile numbers. Even then, never share your PIN. If unsure, call customer care directly.
Are phishing emails always badly written?
No. Many modern phishing emails are well written and use real logos. Focus on the sender address, the link destination and what the message is asking you to do.
Where can I report online scams in Uganda?
You can report to your mobile network or bank, your email provider, and the police. For businesses, keep a record of the message and inform your IT team or service provider.
Conclusion
Phishing works because it plays on trust, fear and hurry. Once you know how to spot phishing emails and messages, most of them become obvious: wrong sender, urgent tone, a link or attachment you did not expect, and a request for something private. Slow down, verify through a channel you trust, and teach your family and staff to do the same. If your business needs secure, professional email with good spam protection, talk to the Baasa Cloud team.