Phishing Scams: A Complete Guide to Recognizing and Avoiding Them

Phishing is behind the majority of data breaches, account takeovers, and online fraud cases in the United States. The FTC, FBI, and CISA all identify phishing as the most prevalent cybercrime threat consumers face. Understanding how it works across different channels is the most fundamental digital safety skill available.

What Phishing Is

Phishing is any attempt to deceive someone into revealing information or taking action by impersonating a trusted entity. The name comes from "fishing", casting a deceptive lure and waiting for victims to bite.

The trusted entity being impersonated can be:

• A bank or financial institution
• A government agency (IRS, SSA, USPS, Medicare)
• A technology company (Microsoft, Apple, Google, Amazon)
• An employer or colleague
• A friend whose account has been compromised
• A retailer, shipping company, or utility provider

The Four Main Types of Phishing

Email phishing. The most common form. A fraudulent email mimics a trusted sender and contains a malicious link, an attachment, or a request to provide information. Volume-based: scammers send millions of emails hoping a fraction will be effective.

Smishing (SMS phishing). Fraudulent text messages. Common variants include fake package delivery notices, bank fraud alerts, toll notices, and prize notifications. See the dedicated smishing article for full details.

Vishing (voice phishing). Phone calls impersonating banks, government agencies, or tech support. The caller creates urgency and asks for information or payment. See the government impostor scams and tech support scams articles.

Spear phishing. Targeted phishing using personalised information about the victim. An attacker who knows your name, employer, and recent purchase history can craft a convincing message. More sophisticated and harder to detect than mass phishing.

Universal Warning Signs

Regardless of the channel or who is being impersonated:

• Urgency and threats. "Your account will be closed in 24 hours," "You will be arrested," "Act now before the offer expires." Urgency is manufactured to prevent rational evaluation.
• Requests for sensitive information. Banks, government agencies, and technology companies do not ask for passwords, PINs, or full Social Security numbers through unsolicited contact.
• Links that do not match. Hover over links before clicking (on desktop) to see the actual URL. Mismatches between display text and actual destination are a clear signal.
• Sender mismatch. The display name may say "Chase Bank" but the actual email address is from a different domain. Always check the actual sending address.
• Unexpected contact about a problem. If you did not initiate the interaction, treat any claim about a problem with your account, a package, or a legal matter with high scepticism.

What Phishing Leads To

Phishing is rarely the end goal, it is the entry point for:

• Account takeover: Stolen credentials used to access banking, email, or retail accounts
• Identity theft: Personal information used to open fraudulent accounts or file false tax returns
• Malware installation: Clicking a link or opening an attachment delivers malicious software
• Financial fraud: Direct theft through fake payment pages or social engineering

The Core Protection Principle

Never provide personal information, passwords, or payment details in response to contact you did not initiate. If you receive a message claiming to be from your bank, the IRS, or any other organisation and you are unsure, hang up or close the message and contact the organisation directly using a number or address you look up yourself.

This single practice eliminates the effectiveness of virtually all phishing attempts.

What to Do If You Responded to a Phishing Attempt

• If you clicked a link but entered nothing: Close the browser, run a security scan, and monitor for suspicious account activity
• If you entered a password: Change it immediately on a trusted device, and on every other account where you use the same password. Enable two-factor authentication.
• If you provided financial information: Contact your bank or card issuer immediately
• If you provided your Social Security number: Place a credit freeze and fraud alert, and file a report at IdentityTheft.gov

Where to Report