Pause before you click: how to spot a phishing email or text

The hint

Make one habit automatic: when a message asks you to click, pay, sign in or share something, stop and check it a different way. Do not use the link or phone number in the message. Open the company's app, type its website address yourself, or call a number you already trust. That single pause defeats almost every phishing attempt, however convincing it looks.

What phishing looks like

Phishing is a message that pretends to come from someone you trust so that you click a harmful link, open an attachment, or hand over a password, card number or money. It arrives by email, text, social media message or phone call.

The US Federal Trade Commission (FTC) says these messages usually tell a story. The sender might:

• Say they noticed suspicious activity or sign in attempts on your account.
• Claim there is a problem with your payment or account.
• Ask you to confirm personal or financial information.
• Include an invoice you do not recognize.
• Want you to click a link to make a payment.
• Say you are eligible for a refund or offer something free.

The FTC adds that real companies will not email or text you a link to update your payment information.

Five warning signs to look for

The US Cybersecurity and Infrastructure Security Agency (CISA) and the FTC point to the same red flags:

1. Urgency or fear. "Your account will be closed today." Pressure is designed to stop you thinking.
2. A request for information. Passwords, codes, card numbers or your Social Security number.
3. Links that do not match. Shortened links, or addresses with a small change, like the made up example amazan.com instead of amazon.com. On a computer, hover over a link to see where it really goes. On a phone, press and hold it to preview the address without opening it.
4. A sender address that is slightly off. The display name says your bank, but the actual email address comes from somewhere else.
5. A generic greeting. "Dear customer" instead of your name.

Do not count on spelling mistakes. CISA notes that in the era of AI, some phishing emails have perfect grammar and spelling. A polished message can still be fake.

How to check a message safely

Ask yourself one question, which the FTC recommends: do I actually have an account with this company, or know this person?

• If not, it is very likely phishing. Report it and delete it.
• If yes, contact them using a phone number or website you know is real, not the details in the message.

For messages that seem to come from friends or family, especially ones asking for money urgently, call or text them on the number you already have. Scammers can fake voices and even video calls, as our deepfake video call case study shows, which is why a family safe word is worth agreeing in advance.

CISA's advice for suspicious messages is short: do not reply, and do not click any link or attachment, including an "unsubscribe" link. Just delete it.

What to do if you already clicked

Stay calm. Phishing fools careful people every day, and acting quickly limits the damage.

1. Stop. Close the page and do not enter anything else.
2. If you typed a password, change it immediately on the real website, typed in yourself. Change it anywhere else you used the same password, and turn on two step verification.
3. If you shared card or bank details, call your bank using the number on your card. If you think a scammer has your Social Security, card or bank number, the FTC directs you to IdentityTheft.gov for step by step recovery.
4. If you opened an attachment or something downloaded, update your security software, run a full scan and remove anything it flags.
5. Watch your accounts for a few weeks, and check whether your email appears in known data breaches.

How to report phishing in the US

Reporting helps stop the same scam reaching others. The FTC says to:

• Forward phishing emails to reportphishing@apwg.org.
• Forward scam texts to 7726 (which spells SPAM).
• Report the attempt at ReportFraud.ftc.gov.

Most email apps also have a Report phishing or Report spam button.

Make phishing less dangerous

A few settings mean that even if you are fooled once, the damage stays small:

• Use a password manager. It will not fill your password into a fake site, which is a useful warning sign. See why a password manager beats memorizing.
• Switch to passkeys where you can. There is no password to steal. Here is how to switch to passkeys.
• Keep software updated on your phone and computer, as the FTC recommends.
• Back up your files, so a ransomware attack after a bad click does not cost you your photos. Our guide covers the 3-2-1 backup rule.

Common mistakes

• Trusting the caller ID or sender name. Both can be faked.
• Calling the number in the message to check. That number goes to the scammer.

Frequently asked questions

What is phishing?

Phishing is when criminals send emails, texts, social media messages or calls that pretend to come from someone you trust, to trick you into clicking a harmful link, opening an attachment, or handing over passwords, money or personal details.

Is bad spelling still a sign of phishing?

Sometimes, but do not rely on it. CISA notes that with AI tools, some phishing emails now have perfect grammar and spelling. Look for urgency, requests for information and odd links instead.

What should I do if I clicked a phishing link?

Do not enter anything else. If you typed a password, change it right away on the real website and turn on two step verification. If you shared financial details, contact your bank and follow the steps at IdentityTheft.gov. If something downloaded, update your security software and run a scan.

How do I report a phishing email or text in the US?

The FTC says to forward phishing emails to reportphishing@apwg.org, forward scam texts to 7726 (SPAM), and report the attempt at ReportFraud.ftc.gov.

How can I check if a message from my bank is real?

Do not use any link or phone number in the message. Open your bank's app, or type its website address yourself, or call the number on the back of your card, and ask.

Sources

1. FTC: How To Recognize and Avoid Phishing Scams
2. CISA: Recognize and Report Phishing
3. FTC: IdentityTheft.gov