What is phishing and how does it work?

Phishing is a cyberattack where criminals send fake emails, texts, or messages that impersonate trusted organizations to trick you into revealing passwords, financial information, or clicking malicious links. It is the #1 attack vector for personal data breaches.

How can I recognize a phishing email?

Look for urgent or threatening language, mismatched sender addresses, generic greetings, suspicious links (hover before clicking), unexpected attachments, and requests for personal information. Legitimate organizations never ask for passwords via email.

What should I do if I clicked a phishing link?

Immediately change your passwords for any accounts that may be compromised, enable multi-factor authentication, run a malware scan, monitor your accounts for unauthorized activity, and consider placing a fraud alert on your credit reports.

Phishing Defense Checklist — You're Already a Target

🎯 Phishing (Email)

Email-based attacks that impersonate trusted organizations to steal credentials or click malicious links.

Never click links in emails from banks, payment services, or tax agenciesGo directly to their website by typing the URL in your browser, or call their phone number. Criminals spoof email headers perfectly. Hover over sender email addresses to see the real addressPhishing emails use "Display Names" that look legitimate but hide the real sender. Right-click and inspect the actual email address. Look for urgency and threats in the email language"Your account will be closed!" "Verify immediately!" "Suspicious activity detected!" These are red flags. Real banks contact you by phone first. Report phishing emails to the organization and your email providerForward phishing emails to the real organization's abuse address (e.g., abuse@bank.com). Also mark as spam/phishing in your email client.

📱 Smishing (SMS)

Phishing via text message. Criminals send fake SMS texts to steal credentials or enable SIM swaps.

Never click links in unsolicited text messagesIf you didn't request a password reset or verification, don't click. Go directly to the app or website instead. Be suspicious of unexpected SMS with short URLs (bit.ly, tinyurl)These hide the real destination. Banks and services use full URLs or no URL at all. Short URLs = phishing. Don't reply to SMS with passwords or verification codesNo legitimate service asks you to reply with a code via SMS. These are always phishing attempts. Report smishing texts to your mobile carrierForward smishing texts to 7726 (SPAM). Most carriers will filter the number and investigate.

📞 Vishing (Voice)

Phone-based phishing. Criminals impersonate tech support, banks, or government agencies to extract information.

Never give passwords, PINs, or SSNs over the phoneNo legitimate service ever asks for these. If someone calls claiming to be your bank, hang up and call the bank directly using the number on your card. Use the family passphrase system when someone callsEstablish a code word that only your family knows. When someone calls claiming to be a family member, ask them the code word before doing anything. Verify caller identity by calling back on a known numberIf someone claims to be from your bank, hang up and call the main customer service number on your card or statement. Don't use numbers they provide. Be suspicious of callers creating urgency or threats"Your Social Security number has been compromised!" "Your account is frozen!" "The IRS is suing you!" Real agencies give you time to respond. Report vishing calls to the FTC at reportfraud.ftc.govAlso report to your state's attorney general. The more reports, the faster they track down criminal call centers.

🕺 Quishing (QR Code)

Phishing via fraudulent QR codes. Criminals place fake QR codes on ads, parking meters, or even replace legitimate ones with their own.

Never scan QR codes from unsolicited emails or textsQR codes in unexpected messages are almost always phishing. If it seems legitimate, go to the website directly instead. Check where QR codes take you before clicking linksMost phones let you preview the URL before opening it. Look at where the QR code takes you. If it's suspicious, don't open it. Be suspicious of QR codes on public surfacesCriminals replace legitimate QR codes on parking meters, ads, and signs with their own. If a QR code looks different or damaged, skip it. Verify payment apps before scanning payment QR codesAlways confirm which app will be used before scanning a QR code for payment. Don't let the app choice surprise you.

🛒 Scams That Reach Everyone

Marketplace sales, the call from “your bank,” spoofed caller ID, and texts that ask for nothing. In the FTC’s 2024 data, people in their twenties lost money in 44% of their fraud reports; people in their seventies, 24%. This is not a parent problem.

Never share your screen or install anything for someone who contacted youNo bank, payment app, buyer or tech support agent ever needs to see your screen or control your computer. Remote-access software is not a step toward the fix. It is the attack. Never send money to receive moneyNot to verify an account, release a payment, collect a prize, or get back money you already lost. Real payments, refunds and paychecks cost you nothing to receive. Check payments inside the app, never from an emailA payment “on hold” until you verify your account is a sentence in an email, not a payment. Open the app yourself. Never call a number an email gave you. Selling locally: cash in person, or wait until the money is in your accountMeet in a public place. Do not ship, and do not hand anything over, until the money is actually sitting in your account. Buying: use the marketplace’s own checkout or a credit cardNever pay a stranger through a payment app, and never send a deposit for something you have not seen. Never move money to a “safe account” for anyone who callsNo real bank moves your money to protect it. Banks freeze accounts; they do not relocate your savings. Hang up and call the number on the back of your card. Never call a phone number that appears in a security warningReal warnings do not give you a number to call. If a window will not close, hold down the power button and restart. Never open your banking app while a stranger is on the phoneNobody legitimate needs to watch you check a balance. “Make sure nothing is missing” is how they learn which account has the most money. Treat caller ID as a label, not proofSpoofing lets a caller show any number, including your bank’s real fraud line. A matching name or number proves nothing. Do not act on any call you did not make. Don’t reply to wrong-number or “want to catch up?” textsThe reply is the point: it proves a real person is on your end. Forward it to 7726, block the number, delete the thread. Anyone you met by accident who later brings up money is running a scam. Don’t scan the QR code in a package you didn’t orderThe code leads to a page that asks for your details or installs malware. Keep the item; you never have to pay for or return something you did not order. Change your shopping passwords.