Phishing or fishing? How phishing scams work and how to spot one
Quick answer
It's spelled phishing, with a ph. Scammers send emails or texts that look like they're from a company you trust to trick you into sharing passwords, card numbers or other personal details. Don't click. Contact the company using a number or site you know is real.
- Comes by
- Email, Text, Phone call, Website
- Last updated
How it works
Phishing means tricking people into giving up sensitive information through a fake message. NIST's glossary describes it as an attempt to get data such as bank account numbers through a fraudulent email or website where the sender pretends to be a legitimate business or reputable person.
The FTC says phishing emails and texts tell a story to get you to click a link or open an attachment. The message may look like it's from a bank, a card company, a utility or a payment app, and it might:
- say they've noticed suspicious activity or log-in attempts
- claim there's a problem with your account or payment information
- ask you to confirm personal or financial information
- include an invoice you don't recognize
- offer a coupon or a government refund
The link goes to a fake site, or the attachment installs malware. If scammers get your login or card details they can reach your email, bank and other accounts, and may sell your information to other scammers.
Red flags
- A generic greeting instead of your name
- A claim that your account is on hold or there's a billing problem
- A link to update your payment details
- Urgency or a threat to close your account
- An invoice or order you don't recognize
- An attachment you weren't expecting
Example message
Your account has been placed on hold due to a billing problem. To avoid interruption, please update your payment details here within 24 hours: [link]
What to do
- 1
Ask whether you have an account
If you don't have an account with the company or don't know the sender, it could be phishing. Report the message, then delete it.
- 2
If you do have an account, check it yourself
Contact the company with a phone number or website you know is real. Don't use the information in the message.
- 3
If you clicked or opened an attachment
Update your computer's security software, run a scan and remove anything it flags.
- 4
If you gave out a password
Change it right away, and on any site where you reused it. Turn on multi-factor authentication.
- 5
If you gave out card, bank or Social Security numbers
Go to IdentityTheft.gov for steps based on what you shared, and call your bank on the number on your card.
- 6
Report it
Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward texts to 7726 (SPAM), and report to the FTC.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Phishing is sent in bulk, but messages that use your name, your bank or your address get far more clicks. Scammers collect those details from people-search sites and data breaches. Serus finds the people-search sites and data brokers that list your phone number and address and removes you from them, and alerts you when your details show up in a breach, so fewer scammers can reach you.
Frequently asked
Is it phishing or fishing?
Phishing, with a ph. It's the term for tricking people into handing over information through fake messages.
Can phishing come by text or phone?
Yes. The FTC covers phishing by email and text, and the same trick is used in calls and fake websites.
How do I protect my accounts even if I fall for one?
The FTC recommends multi-factor authentication, which makes it harder for scammers to log in even if they have your password. Keep security software and phone updates automatic too.
Where do I report a phishing message?
Forward emails to reportphishing@apwg.org, texts to 7726 (SPAM), and report to the FTC at ReportFraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
