A phishing email or text is a message that pretends to come from a company or person you trust to trick you into clicking a link, sharing a password or code, or sending money. The biggest warning signs are urgency (“your account will be closed today”), a request for personal or payment information, a sender address or link that does not match the real company, and an offer or problem you did not expect. When in doubt, do not click: open the company’s app or type its website yourself. This guide shows how to spot phishing, real examples of common tricks and what to do if you clicked.
The 7 warning signs of phishing
- Urgency or fear: “Your account is locked”, “Payment failed”, “Act within 24 hours”.
- A request for sensitive information: passwords, verification codes, card numbers or your Social Security number.
- A mismatched sender: the name says “Amazon” but the address is a random Gmail account or a strange domain.
- Suspicious links: hover over a link on a computer, or long-press it on a phone, to see the real address. Look-alike domains swap letters or add extra words.
- Something you did not expect: an invoice for something you did not buy, a delivery you are not waiting for or a prize you did not enter.
- Unusual payment requests: gift cards, crypto or wire transfers. Real companies and government agencies do not ask for these.
- Generic greetings and small errors: “Dear customer” and odd wording. AI tools now make scams more polished, so do not rely on spelling mistakes alone.
Common phishing stories
| The message says… | What the scammer wants |
|---|---|
| “We noticed suspicious activity on your account” | Your password on a fake login page |
| “Your package could not be delivered” | A small “redelivery fee” and your card details |
| “Your storage is full” or “Your subscription expired” | Your email or cloud account password |
| “Here is your invoice” for something you never bought | A call to a fake support number, or malware in an attachment |
| “You are eligible for a refund” | Your bank details |
| “Hi Mom, I lost my phone, this is my new number” | An urgent money transfer |
| “We sent you a code by mistake, please send it back” | Your two-factor code, to take over your account |
How to check a suspicious message safely
- Do not use the links or numbers in the message. Open the official app, or type the company’s address into your browser yourself.
- Check your account directly. If there is a real problem, you will see it there.
- Call the person on a number you already know if a friend or family member asks for money.
- Do not open unexpected attachments, especially files that ask you to “enable content” or log in to view them.
- Scan QR codes with care. Scammers put fake QR codes on parking meters, flyers and emails. Check the address your camera shows before opening it. Learn how QR codes work in our guide to making a Wi-Fi QR code.
How to protect yourself before it happens
- Use passkeys or two-factor authentication. A passkey only works on the real website, which stops most phishing. See what are passkeys and how to turn on two-factor authentication.
- Use a password manager. It will not autofill your password on a fake site, which is an instant warning sign.
- Use unique passwords, so one stolen password does not unlock your other accounts. Our Password Generator helps.
- Keep your phone, computer and browser updated, and turn on your email provider’s spam filtering.
- Be careful with AI-made content. Scammers use AI voices, images and videos. Read how to tell if an image is AI-generated.
What to do if you clicked or replied
- If you entered a password: change it right away on the real site, and anywhere else you used it. Sign out of other sessions and turn on 2FA.
- If you shared card or bank details: call your bank using the number on your card and ask them to block it.
- If you shared a 2FA code: change your password and check your account’s security settings for new devices or recovery details you do not recognize.
- If you downloaded a file: disconnect from the internet and run a full security scan.
- If you shared personal information such as your Social Security number, visit IdentityTheft.gov for a recovery plan.
How to report phishing in the US
- Emails: forward them to reportphishing@apwg.org and use your email app’s “Report phishing” or “Report spam” button.
- Texts: forward them to 7726 (SPAM) and use your messaging app’s “Report junk” option.
- Scams and losses: report them to the Federal Trade Commission at ReportFraud.ftc.gov.
- The company being impersonated: most have a page or address for reporting fake messages.
Phishing also hides inside QR codes. Learn how to scan a QR code from a screenshot and check the link safely before you open it.
Missing emails can be a warning sign too: attackers sometimes add hidden forwarding rules. See why Gmail is not receiving emails and how to fix it.
Frequently asked questions
Can I get hacked just by opening a phishing email?
Rarely. The danger usually comes from clicking links, opening attachments, entering details or replying. Delete the message and report it.
What is smishing?
Smishing is phishing by text message (SMS). Fake delivery, toll payment and bank alerts are common examples.
Are phishing messages getting harder to spot?
Yes. AI helps scammers write clean, personalized messages. Focus on the request itself: urgency plus a link, code or payment request is the real red flag.
Can AI chatbots help me check a message?
They can point out warning signs if you paste the text, but remove personal details first, and never click the link to “test” it. See our AI chatbot privacy settings guide.
Slow down and verify
Phishing works by rushing you. Whenever a message pushes you to click, pay or share a code quickly, stop, open the official app or website yourself and check. That one habit defeats most scams.
Sources
This article is based on the official documentation and reporting listed in the sources above, checked on October 19, 2026. Features and prices change, so confirm details on the official pages before you buy. ShokokoTech does not accept payment for coverage. Read our editorial policy.
