A message arrives saying your package could not be delivered, your bank account has been locked, or you have won a gift card you do not remember entering to win. It looks official, it sounds urgent, and it includes a handy link to fix everything. That is exactly what makes phishing so effective: it borrows the look and tone of companies you already trust and catches you in a busy moment.
The good news is that most scam messages follow a handful of predictable patterns. Once you know what to look for, they become much easier to spot, whether they show up in your inbox, as a text message, or in a chat app. This guide explains how phishing works, the warning signs to check, what to do if you clicked something you should not have, and how to make yourself a harder target in the future.
What phishing actually is
Phishing is a type of fraud in which someone pretends to be a trusted person or organization to trick you into handing over something valuable. That might be a password, a credit card number, a one-time security code, personal details, or access to your computer. Sometimes the goal is to get you to send money directly, for example by buying gift cards or making a wire transfer.
The name comes from the idea of “fishing” for victims: scammers send out a large number of messages and wait for someone to bite. Variations have their own names. Phishing by text message is often called smishing, and phishing by phone call is called vishing. Highly targeted attacks aimed at a specific person, often using details gathered from social media or a company website, are known as spear phishing.
Agencies such as the Federal Trade Commission (FTC) and the Cybersecurity and Infrastructure Security Agency (CISA) consistently list phishing among the most common ways people lose money and accounts online. It is not a problem that only affects careless or inexperienced users. Well-crafted messages fool smart, tech-savvy people every day.
Why phishing works so well
Scammers rely less on technology and more on human psychology. Understanding the emotional buttons they push makes it easier to notice when one is being pressed.
- Urgency: “Your account will be closed in 24 hours.” Time pressure discourages you from stopping to think.
- Fear: Messages about suspicious logins, unpaid tolls, tax problems, or legal trouble are designed to make you panic.
- Authority: Pretending to be a bank, a government agency, your employer, or a well-known brand lends instant credibility.
- Reward: Prizes, refunds, and unexpected money appeal to curiosity and excitement.
- Helpfulness: A message that appears to come from a friend or coworker in trouble plays on your desire to help.
If a message makes you feel a sudden rush of worry or excitement, treat that feeling as a signal to slow down. Legitimate organizations rarely need you to act within minutes.
Warning signs in phishing emails
No single clue proves an email is fake, but several red flags together should make you very suspicious. Run through these checks whenever a message asks you to click, log in, pay, or share information.
Check the sender’s address, not just the name
Email apps usually show a display name, such as “Customer Support,” which anyone can set to anything. Tap or hover over the name to see the actual address. Look for misspellings of a company name, extra words or numbers added to a familiar domain, or a free email service being used by an organization that would normally have its own domain. Be aware that even a correct-looking address can occasionally be spoofed, so a familiar sender is not a guarantee on its own.
Look closely at links before clicking
On a computer, hover your mouse over a link without clicking to preview where it really goes. On a phone, press and hold the link to see the address. Be suspicious if the destination does not match the company the email claims to be from, if it uses a link-shortening service, or if the real company name appears somewhere in the middle of an unfamiliar address rather than as the main domain.
Watch for generic greetings and odd details
“Dear customer” or “Dear user” in a message from a company that knows your name is a warning sign. So are mismatched logos, unusual formatting, and awkward phrasing. That said, modern scams are often polished and free of spelling errors, so do not treat good grammar as proof that a message is safe.
Be wary of unexpected attachments
Invoices, shipping labels, voicemails, and “secure documents” you were not expecting are common delivery methods for malware. Files that ask you to enable macros or editing to view their content deserve extra suspicion. If you were not expecting an attachment, confirm with the sender through another channel before opening it.
Notice requests that legitimate companies do not make
Banks, government agencies, and major tech companies generally will not ask you to confirm your full password, share a one-time security code, or pay with gift cards or cryptocurrency by email. A request like that is one of the clearest signs of a scam.
Warning signs in text message scams
Text messages feel more personal and immediate than email, and phone screens make it harder to inspect links and senders. Scammers know this, which is why smishing has grown so common. Here are the patterns to watch for.
- Delivery problems: A text claiming a package is held up and asking you to update your address or pay a small redelivery fee.
- Unpaid tolls or fines: Messages warning of an overdue toll, parking ticket, or traffic violation with a link to pay immediately.
- Bank or card alerts: “Did you authorize this purchase? Reply YES or NO,” followed by a call from someone posing as the fraud department.
- Account verification codes: A text asking you to forward a code you just received. That code is often the key to taking over one of your accounts.
- Wrong-number openers: A friendly message apparently sent to the wrong person, which turns into a long conversation and eventually a pitch for an investment or a request for money.
- Job offers: Unsolicited offers of easy, well-paid remote work that require you to pay upfront or share banking details.
Be cautious about replying at all, even with “STOP,” to a message you believe is a scam. A reply confirms that your number is active and that a real person reads it. Instead, use your phone’s built-in option to report the message as junk and block the sender.
Phishing beyond email and text
The same tricks appear across other channels, so the habits you build for email should carry over.
Phone calls
Caller ID can be faked, so a call that appears to come from your bank or a government office may not. A common pattern combines a text and a call: you receive a fraud alert text, then a caller who sounds professional walks you through “securing” your account, which actually means giving them access. If you get a call like this, hang up and call back using the number on the back of your card or on the organization’s official website.
Social media and messaging apps
Scammers create fake customer support accounts, impersonate friends whose accounts have been hacked, and send direct messages with prize offers or urgent requests. If a friend suddenly asks for money or a code, contact them another way to confirm it is really them.
Fake websites and search ads
Some scams start with you rather than a message. Fake websites can appear in search results or ads, looking almost identical to real banks, shops, or support pages. Typing a company’s address directly or using a bookmark you saved yourself is safer than clicking a search ad when you plan to sign in.
How to verify a message safely
The most powerful habit you can build is simple: never use the contact information provided in a suspicious message to check whether it is real. Scammers control the links, phone numbers, and reply addresses in their own messages. Instead, go to the source yourself.
- Pause and do not click any links or open any attachments.
- Open the company’s official app, or type its web address directly into your browser, and sign in from there. If there is a real problem with your account, it will usually appear in your account dashboard or messages.
- If you want to talk to someone, call a number you find independently, such as one on your card, a statement, or the company’s official website.
- For messages that seem to come from a friend, family member, or coworker, contact them through a different channel than the one the message arrived on.
- If you still are not sure, delete the message. A legitimate organization will find another way to reach you.
What to do if you clicked or replied
It happens to careful people too, and acting quickly can limit the damage. Do not let embarrassment slow you down. This is general information, not professional legal or financial advice, so contact your bank or the relevant organization directly for guidance on your specific situation.
If you entered a password
Change that password right away, starting from the real website or app, not the link in the message. If you use the same password anywhere else, change it on those accounts too. Turn on multi-factor authentication if it is not already enabled, and check the account’s security settings for unfamiliar devices, forwarding rules, or recovery contacts that you did not add.
If you shared financial information
Contact your bank or card issuer immediately using the number on your card or official website. Explain what happened and ask about blocking the card, monitoring for fraud, or reversing any unauthorized charges. Review your recent transactions for anything you do not recognize.
If you downloaded a file or gave someone remote access
Disconnect the device from the internet, run a full scan with your built-in security software, and change important passwords from a different, trusted device. If someone had remote control of your computer, consider getting help from a reputable local technician.
Report it
In the United States, you can report phishing and fraud to the FTC at its ReportFraud website, and forward scam text messages to 7726 (which spells SPAM on a keypad) so your mobile carrier can investigate. You can also report phishing emails using the built-in “report phishing” or “report junk” option in your email app, and notify the company that was impersonated. If your identity may have been stolen, the FTC’s IdentityTheft website offers a step-by-step recovery plan.
How to make yourself a harder target
You cannot stop scammers from sending messages, but a few protective habits can stop most attacks from succeeding.
- Turn on multi-factor authentication for your email, bank, and social media accounts. Even if a scammer gets your password, they will have a much harder time getting in. CISA recommends phishing-resistant options, such as passkeys or security keys, where they are available.
- Use a password manager to create unique passwords for each account. A side benefit is that a good password manager will not offer to fill your login on a fake site, which is a useful warning.
- Keep your devices and apps updated so security fixes are installed promptly.
- Use built-in spam filters and call blocking on your email and phone.
- Limit what you share publicly on social media, such as your employer, birthday, or travel plans, since scammers use these details to make messages more convincing.
- Talk about scams with family, especially older relatives and teenagers, who are frequent targets. Agreeing on a family code word for emergencies can help defeat “a relative is in trouble” scams.
Quick checklist: is this message a scam?
| Ask yourself | Red flag if |
|---|---|
| Was I expecting this message? | It arrived out of the blue about an account, package, or prize. |
| Is it pressuring me? | It demands action within hours or threatens consequences. |
| Who really sent it? | The address or number does not match the organization. |
| Where does the link go? | The real destination is unfamiliar or shortened. |
| What is it asking for? | Passwords, codes, card numbers, gift cards, or crypto. |
| Can I verify it independently? | The only way to respond is through the message itself. |
Common mistakes to avoid
- Trusting a message because it uses your name or details. Personal information is often available from data breaches or social media.
- Assuming the padlock icon means a site is safe. It only means the connection is encrypted. Scam sites can have one too.
- Calling the number in a suspicious message. Always look up the official number yourself.
- Sharing one-time codes with anyone. Real support staff will not ask you to read them a code you received.
- Staying quiet after being fooled. Reporting quickly protects you and can help warn others.
Frequently asked questions
Can I get hacked just by opening a phishing email?
For most people using updated email apps, simply opening a message is low risk. The danger usually comes from clicking links, opening attachments, or replying with information. Keeping your software up to date further reduces the risk.
Is it safe to click “unsubscribe” in a suspicious email?
Not in an email you think is a scam. The unsubscribe link can lead to a malicious page or confirm that your address is active. Mark the message as spam or phishing instead. For legitimate newsletters from companies you recognize, unsubscribing is generally fine.
Why do I keep getting scam texts?
Phone numbers are often collected from data breaches, bought from list sellers, or simply generated at random. Reporting messages, forwarding them to 7726, and using your phone’s spam filtering can help reduce how many reach you over time.
What if the message looks like it came from my own company?
Follow your workplace’s process for reporting suspicious messages, which often means using a report button or forwarding to the IT or security team. Do not try to investigate the links yourself.
The bottom line
Phishing works by rushing you, so your best defense is to slow down. Check who really sent a message, never use the links or phone numbers inside a suspicious one, protect your accounts with multi-factor authentication, and report scams when you see them. With those habits in place, most fake emails and texts lose their power to fool you.