Phishing is often more effective than trying to break a password technically.
Example
"Your Instagram account violates our rules. It will be deleted in 24 hours. Appeal here."
The message manufactures urgency, fear, and a link. This is exactly the moment to slow down.
The right reflex
Instead of:
message → link → sign in
Do:
close the message
→ open Instagram yourself
→ check the notifications in the appSame principle for your bank, Apple, Amazon, PayPal, the tax office and delivery companies.
Check the domain
apple.com
apple-verification-security-example.comThese two addresses are not the same domain. But for a beginner the simplest rule is: do not use the link you received, open the official app directly.