Advice about spotting phishing usually mentions spelling errors and odd formatting. That advice is obsolete. Messages are now well written, correctly branded, and frequently personalised with real details.
What still works as a signal
Urgency. Almost every phishing message needs you to act immediately – an account closing, a payment failing, a delivery held. The pressure exists to prevent you from checking.
An unexpected request for credentials or payment details, however plausible the reason.
A link where the destination does not match the sender. Hover over it, or long-press on a phone, and read the actual domain. Look at what comes immediately before the top-level domain, since attackers put the real brand name elsewhere in the address.
The check that never fails
Do not use the link. Go to the service the way you normally do – your bookmark, the app, typing the address – and see whether the thing the message claims is actually there.
If your bank needs you, it will be visible when you log in normally. If it is not there, the message was false.
Voice and video
Cloned voices are now cheap and convincing. A call from a family member in distress asking for money urgently should be verified by calling them back on the number you have.
Agreeing a word within your family for exactly this situation sounds paranoid and takes one conversation.
If you clicked
Change the password immediately, from a different device if you can. Check for unfamiliar login sessions and remove them. Tell whoever runs the system.