Fraud Cleanup

What a Phishing Scam Is and What to Do Now

You clicked a strange link or answered an odd email. Here is what phishing is, what the scammer wants, and what to do next.

You clicked the link. Or you opened the attachment. Or you typed your password into a page that now feels wrong. Your mind is racing through what could happen next. Slow down and read this.

What a phishing scam actually is

The FBI says phishing involves emails designed to get victims' personally identifiable information or financial credentials. The FTC says scammers use email or text messages to trick you into giving them your personal and financial information. What they want is your passwords, your account numbers, or your Social Security number.

The fake website behind the message is made solely to steal your information, the FBI says. It may look like the real company's site. It exists to capture whatever you type into it.

Once a scammer has your details, the FTC says they may be able to reach your email, bank, or other accounts. Your details might also be passed along to other scammers, the FTC says. For people who hand over their details, phishing emails can lead to identity theft.

The stories a phishing scammer tells

The FTC says phishing emails and text messages often tell a story to trick you into clicking on a link or opening an attachment. The story is built to spark fear or hope before you can think. Here are the ones the FTC names.

Odd log-ins. The scammer claims there were suspicious log-in attempts on your account. There were none. The claim is invented to make you log in fast.

A problem with your account. They claim there is a problem with your account or your payment information. There is not. One sign of a scam email is that it says your account is on hold because of a billing problem.

A request to confirm information. They say you need to confirm some personal or financial information. You do not. The FBI says companies generally do not contact you to ask for your username or password. A real company will not email or text you a link to update your payment information either, the FTC says.

A fake invoice. They include an invoice you do not recognize. It is fake.

A payment link. They want you to click on a link to make a payment. The link has malware.

A government refund. They say you are eligible to register for a government refund. It is a scam.

Free stuff. They offer a coupon for free stuff. It is not real.

Who do they pretend to be while telling these stories? The FBI says scammers typically pose as a creditor, bank, or state benefits agency. A name you trust makes the story land. For a walkthrough of one message in detail, see this phishing scam example.

Link phishing relies on small visual tricks. The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust. The address may be one letter off from the real one. The sender name may show a company you know while the address behind it belongs to someone else.

The FBI says phishing schemes often use spoofing techniques to lure you in and get you to take the bait. Spoofing makes a message look like it came from a person or company it did not come from.

Do not trust the surface of a message. The FTC says a scam email may use a company's real logo in the header and still be fake. PayPal's page adds that typos, misspellings, and incorrect grammar are common in phishing messages.

What about the padlock in your browser? PayPal's page says many fake sites show a padlock symbol in the address bar, so you should not rely on it. The letter s in https does not always mean a site is legitimate either, because hackers can build encrypted sites too.

So how can you tell if a link is real before you click it? The FBI says not to click on anything in an unsolicited email or text message. Instead, look up a company's phone number on your own and call the company to ask if a request is legitimate.

What happens if you already clicked or replied

Maybe nothing was taken. Maybe you typed your password into a fake page.

If you clicked but typed nothing. Attachments and links might install harmful malware, the FTC's advice says. Watch your device for odd behavior. The FBI says to set up two-factor or multi-factor authentication on any account that allows it and never disable it. The FTC says this makes it harder for scammers to log in to your accounts if they do get your username and password.

If you opened an attachment. PayPal's page says attachments can contain malware, so you should never open them unless you are completely sure they are legitimate. The FBI says never to open an email attachment from someone you don't know and to be wary of attachments forwarded to you. If you opened one, treat the device as at risk and let your security software scan it.

If you sent your password or account details. The FTC says a scammer holding your details may be able to reach your email, bank, or other accounts. Change the password on the account you gave up, and on any other account using the same password. Turn on multi-factor authentication if it is not already on. If a bank account or payment app was hit, contact that bank or app directly.

If you gave payment details. Do not use the link in the message to fix anything. Look up the company's real contact info yourself. For a version of this scam that uses PayPal's name, see this email scam PayPal page.

How to make yourself a harder target

You cannot stop every phishing attempt, but you can make the ones that reach you matter less.

Ask the first question. The FTC says to ask yourself whether you have an account with the company or know the person who contacted you. If the answer is no, it could be a phishing scam.

Turn on multi-factor authentication. The FTC says to protect your accounts by using multi-factor authentication.

Keep your software updated. The FTC says to protect your computer with security software that updates itself. It also says to set your cell phone's software to update automatically.

Back up your data. The FTC says to protect your data by backing it up.

Never send sensitive info in a message. PayPal's page says you should never give personal, credit card, or account info through email, text, or phone.

Why do these emails reach you at all? The FTC says your email spam filters might keep many phishing emails out of your inbox. But scammers are always trying to outsmart spam filters, so extra layers of protection can help.

How to report a phishing scam

The FTC says that when a message shows signs of phishing, you should report it and delete it. Here is where each report goes.

The message itself. The FTC's advice says that if you got a phishing email, you should forward it to the Anti-Phishing Working Group at reportphishing@apwg.org. If you got a phishing text message, forward it to SPAM (7726).

The scam attempt. The FTC's advice says to report the phishing attempt to the FTC at ReportFraud.ftc.gov.

The FBI. The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov.

After that, get rid of the message. There is no reason to leave it sitting in your inbox. For a broader look at the scam family this belongs to, start with phishing.

You clicked a link or handed over information, and that fear is real. Work through them, then give the rest of your attention to the habits that make the next message easy to ignore.

Sources