Scams

Phishing: how to spot fake emails, texts and calls

Phishing messages no longer look like badly spelled emails from a prince. They look like your bank, your delivery company, your new employer's HR team or a toll agency asking for $3.95. The giveaway is rarely the logo. It is what the message asks you to do.

Red flags, wherever the message arrives

Phishing has the same shape whether it comes as an email, a text, a direct message or a call:

A familiar name. Your bank, a delivery service, a tax agency, a streaming service, your employer, a toll road.
A problem or a prize. A locked account, a failed delivery, an unpaid toll, a refund, a job offer.
Urgency. "Within 24 hours", "final notice", "your account will be closed".
A request. Click this link, sign in here, confirm your card, read me the code we just sent, call this number, scan this QR code.

Also look for a sender address or link that does not quite match the real organisation, generic greetings, unexpected attachments and requests to move a conversation to another app. But do not rely on spotting mistakes: many phishing messages are polished, and some come from real accounts that were hacked.

The verify-first routine

Instead of judging every message, use one rule: never act on the message itself. If it might be real, go to the organisation another way.

Close the message without clicking anything.
Open the official app, or type the website address you know into your browser.
Sign in there and check for alerts, or call the number on your card, statement or the official website.
If there is a real problem, it will be there. If not, report and delete the message.

This works whether the message is clumsy or perfect, which is why it beats trying to spot fakes.

Codes are keys

One-time codes sent by text or app are the second lock on your accounts. Legitimate companies will not call or message you to ask you to read a code back to them. Anyone who asks for one is trying to get into your account. The same goes for requests to approve a sign-in prompt you did not start.

If you already clicked or shared

Act quickly; the steps depend on what you gave away.

What happened	What to do now
Clicked a link but entered nothing	Close the page. Run your device's security updates and any security scan you use. Watch accounts for unusual activity.
Entered a password	Change it right away on the real site, and anywhere else you used the same password. Turn on two-step verification.
Shared a one-time code or approved a prompt	Sign in through the official app, change the password, sign out other sessions and contact the company.
Entered card or bank details	Call your bank or card issuer using the number on the card. Ask them to block the card and watch for charges.
Shared your Social Security number	Freeze your credit at all three bureaus and visit IdentityTheft.gov for a recovery plan.
Sent money	Contact the payment company or bank immediately to try to stop or reverse it, then report at ReportFraud.ftc.gov.

Report it

Reporting helps protect other people. Use your email provider's "report phishing" button, report scam texts as junk in your messaging app, and report scams to the FTC at ReportFraud.ftc.gov. CISA's guidance on phishing explains more ways to report, including to your employer's IT team for work accounts.

Make yourself a harder target

Phishing works best on accounts protected by a password alone. Two-step verification, ideally with an authenticator app or a security key rather than text messages, means a stolen password is not enough. A password manager helps too: it will not autofill your password on a fake site whose address does not match the real one, which is a useful warning in itself. Keep your phone and computer updated so that malicious links and attachments have fewer weaknesses to exploit.

Phishing defence checklist

Tick items as you go. Ticks stay on this page only and clear when you leave.

Turn on two-step verification for email, banking and phone carrier accounts.
Never share one-time codes with anyone who contacts you.
Open accounts by typing the address or using the official app, not links in messages.
Call back using a number you looked up yourself.
Report phishing emails with your email provider's report button and scam texts with your phone's report-junk option.
Report scams at ReportFraud.ftc.gov.

Questions people ask

What is phishing?

Phishing is a message, by email, text, phone call or social media, that pretends to come from a trusted source to trick you into sharing passwords, account numbers or codes, paying money or installing malicious software.

Is it safe to open a phishing email?

Simply opening an email is usually low risk. The danger is in clicking links, opening attachments, replying with information or calling numbers in the message. If in doubt, delete it, or report it with your email provider's report button.

My bank texted me a code I did not ask for. What now?

Someone may be trying to sign in to your account. Do not share the code with anyone, including someone who calls claiming to be your bank. Sign in through the official app or website, change your password and contact the bank using the number on your card.

What is smishing and vishing?

Smishing is phishing by text message and vishing is phishing by voice call. Both work the same way as email phishing and use the same pressure tactics.