How to Spot a Phishing Email or Text

Phishing invents a problem that needs you right now.

Phishing emails and texts try to steal passwords, account numbers, or Social Security numbers, and they usually look like they come from a bank, a card issuer, a utility, or a payment app you know. The FTC lists the stories they tell:

• suspicious activity or sign-in attempts on your account
• a problem with your account or your payment information
• a request to confirm personal or financial details
• an invoice you do not recognize
• a link to make a payment
• a government refund you are supposedly eligible for
• a coupon for free stuff

Each one is a reason to act before you check.

Judge the request, not the design.

The FTC’s sample phishing email carries the real company’s logo in its header. What gives it away is everything else: a generic greeting, a claim that the account is on hold because of a billing problem, and a link to update payment details. Legitimate companies, the FTC notes, won’t email or text you a link to update your payment information.

Do I have an account with this company, or know this person?

If the answer is no, treat the message as phishing: report it, then delete it. If the answer is yes, still use nothing in the message. Contact the company through a phone number or website you already know is real — a bookmark, or the number on your card or statement — and ask whether the message is genuine. Links and attachments are how phishing installs malware, so leave them alone until you have checked.

Assume one message will get through eventually.

The FTC recommends four protections: security software on your computer, set to update automatically; automatic updates on your phone; multi-factor authentication on your accounts, so a stolen password is not enough on its own (see which method to use); and regular backups of your computer and phone, to an external drive or the cloud.

What you gave away decides the next step.

If you think a scammer has your Social Security, credit card, or bank account number, go to IdentityTheft.gov for the steps that match each kind of information. If you typed a password, change it right away, and the username if you can, along with any other account where you used the same password, and turn on two-factor authentication. If you opened an attachment or a link that may have downloaded something, update your security software, run a scan, and remove anything it finds. The data breach guide covers credit freezes.

Reports feed the filters that protect everyone.

Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, and forward phishing texts to SPAM (7726). You can also report the attempt to the FTC at ReportFraud.ftc.gov.