Fraud Cleanup

What Phishing Means and How to Spot It

A plain answer to what phishing is, the stories these messages tell, and what to do about one right now.

What phishing means, in plain terms

Phishing is a scam that arrives as a message. The FBI says phishing involves emails designed to get your personally identifiable information or your financial credentials. The FTC says scammers use email or text messages to trick you into giving them your personal and financial information.

What they want is simple. The FTC says they try to steal your passwords, account numbers, or Social Security number. With those, the FTC says scammers could get access to your email, bank, or other accounts. They could also sell your information to other scammers.

The FBI says scammers typically pose as a creditor, a bank, or a state benefits agency. So the message looks like it comes from a company you trust. It does not.

How phishing works: the story the message tells

The FBI says phishing schemes often use spoofing techniques to lure you in and get you to take the bait. Spoofing means faking the sender, the phone number, or the web address so the message looks real.

Then comes the story. The FTC says phishing emails and text messages often tell a story to trick you into clicking on a link or opening an attachment. Common stories include:

  • They noticed suspicious activity or log-in attempts. There were none.

  • There is a problem with your account or your payment information. There is not.

  • You need to confirm some personal or financial information. You do not.

  • You have an invoice you do not recognize. It is fake.

  • You must click a link to make a payment. The link has malware.

  • You are eligible for a government refund. It is a scam.

  • You won a coupon for free stuff. It is not real.

    If you want to see how one of these plays out, read a phishing scam example.

Common signs of a phishing email

The FTC says a scam email may use a company's real logo in the header and still be fake. Logos are easy to copy. They prove nothing.

Here is what the FBI, the FTC and PayPal say to check instead:

  • A billing problem. The FTC says one sign of a scam email is that it says your account is on hold because of a billing problem.
  • A link to update payment details. The FTC says another sign is an invitation to click a link to update your payment details. The FTC says legitimate companies will not email or text you a link to update your payment information.
  • Small differences in addresses. The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust. Look closely at the sender and any web address.
  • Typos and bad grammar. PayPal's page says typos, misspellings, and incorrect grammar are common in phishing messages.
  • A padlock or https. PayPal's page says many fake sites show a padlock symbol in the address bar, so you should not rely on it. PayPal's page also says the letter s in https does not always mean a site is legitimate, because hackers can build encrypted sites too.

The FBI says fake websites used in phishing are made solely to steal your information. If a link takes you to a page that asks you to log in, stop.

Phishing by text and phone: smishing and vishing

Phishing is not just email. The FBI says smishing uses SMS text messages instead of email. The FBI says vishing uses phone calls, generally with an automated voice.

PayPal's page says scammers can easily fake a Caller ID, so a call that says PayPal is not necessarily from PayPal. The name on your screen can lie.

How to protect yourself from phishing

The FTC says your email spam filters might keep many phishing emails out of your inbox. But the FTC also says scammers are always trying to outsmart spam filters, so extra layers of protection can help. The FTC recommends these:

  • Security software. The FTC says to protect your computer by using security software set to update automatically.
  • Phone updates. The FTC says to protect your cell phone by setting its software to update automatically.
  • Multi-factor authentication. The FTC says to protect your accounts by using multi-factor authentication. The FTC says this makes it harder for scammers to log in to your accounts if they do get your username and password.
  • Backups. The FTC says to protect your data by backing it up.

The FBI adds one more habit. The FBI says companies generally do not contact you to ask for your username or password. So a message that asks for either is a warning sign.

The FBI also says to look up a company's phone number on your own and call the company to ask if a request is legitimate. Use the number on your card or your bill, never the one in the message.

What to do if you get a phishing message

First, the FBI says not to click on anything in an unsolicited email or text message. No links, no attachments. The FTC's advice says attachments and links might install harmful malware.

Second, the FTC says to ask yourself whether you have an account with the company or know the person who contacted you. The FTC says if the answer is no, it could be a phishing scam.

Third, if you already clicked and gave up information, act fast. The FTC says phishing emails can lead to identity theft for people who give scammers their information. If money moved through a payment app, our page on the email scam PayPal covers what to do next.

Where to report phishing

The FTC says if you see signs of a phishing scam, report the message and then delete it. Here is where the FTC's advice says to send it:

  • A phishing email. Forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.
  • A phishing text message. Forward it to SPAM (7726).
  • Any phishing attempt. Report it to the FTC at ReportFraud.ftc.gov.

The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov.

Then delete the message. For a wider look at this kind of fraud, see our page on the phishing scam.

Sources