Skip to content

How to Spot a Phishing Email or Text, and What to Do

Key takeaways

  • Phishing messages try to trick you into giving away passwords, account numbers or Social Security numbers, or into clicking a harmful link or attachment.
  • Common signs include urgent or scary wording, requests for personal or financial information, odd web addresses and a generic greeting.
  • A real company won’t email or text you a link to update your payment information, says the FTC.
  • If you’re unsure, don’t click. Contact the company using a phone number or website you already know is real.

This article is general information based on US government guidance. It can’t cover every scam.

What is phishing?

The FTC says scammers use email or text messages to try to steal your passwords, account numbers or Social Security number. If they get that information, they could get into your email, bank or other accounts, or sell your details to other scammers. The US cybersecurity agency CISA adds that phishing messages can also arrive as social media messages or phone calls, and are often “designed to look like they come from a trusted person or organization.”

Signs of a phishing message

The FTC says phishing messages often tell a story to get you to click a link or open an attachment. The sender may claim to be a bank, credit card company, utility or online payment service, and might:

  • say they’ve noticed suspicious activity or login attempts,
  • claim there’s a problem with your account or payment information,
  • say you need to confirm personal or financial information,
  • include an invoice you don’t recognise,
  • ask you to click a link to make a payment,
  • say you’re eligible for a government refund,
  • offer a coupon or something free.

CISA lists these signs to look for:

  • Urgent or emotional language, especially messages that claim dire consequences if you don’t respond immediately.
  • Requests for personal or financial information.
  • Shortened web addresses you don’t trust.
  • Wrong email addresses or links, such as “amazan.com” instead of the real name.

CISA also notes that poor spelling and grammar used to be a giveaway, but in the era of artificial intelligence some phishing emails now have perfect grammar and spelling. So don’t rely on typos to spot a scam.

An example from the FTC

The FTC shows a fake email that uses a real company’s logo. It gave these signs: a generic greeting, a claim that your account is on hold because of a billing problem, and an invitation to click a link to update your payment details. The FTC says that while real companies might email you, “legitimate companies won’t email or text with a link to update your payment information.”

Four ways to protect yourself

The FTC recommends:

  1. Use security software on your computer, and set it to update automatically.
  2. Keep your phone’s software up to date, with automatic updates turned on.
  3. Use multi-factor authentication. This asks for two or more credentials to log in: something you know (a password or PIN), something you have (a one-time code or security key), or something you are (a fingerprint or face scan). The FTC says it makes it harder for scammers to get into your accounts even if they have your password. See our guide to two-factor authentication for how to turn it on.
  4. Back up your data on your computer and phone, to an external drive or the cloud.

CISA also advises using strong passwords, ideally with a password manager, and installing software updates promptly.

What to do if you get a suspicious message

The FTC suggests asking yourself: “Do I have an account with the company or know the person who contacted me?”

  • If not, it could be phishing. Report the message and then delete it.
  • If yes, contact the company using a phone number or website you know is real, not the details in the message. Links and attachments may install harmful software.

CISA’s three steps are to recognise the signs, resist clicking, and delete the message without replying or clicking any link, including an “unsubscribe” link. If a message could be real, look up the company’s website yourself, or reach the person another way to check whether they contacted you.

What to do if you already responded

The FTC says:

  • If you think a scammer has your Social Security, credit card or bank account number, go to IdentityTheft.gov, which gives steps based on what you shared.
  • If you think you clicked a link or opened an attachment that downloaded harmful software, update your computer’s security software, run a scan and remove anything it finds.

How to report phishing

The FTC asks you to report it, because the information helps fight scammers:

  • Forward a phishing email to the Anti-Phishing Working Group at reportphishing@apwg.org.
  • Forward a phishing text to 7726 (SPAM).
  • Report it to the FTC at ReportFraud.ftc.gov.

CISA adds that many email apps have a “report spam” or “report phishing” button.

Frequently asked questions

Can I trust an email with a company’s logo? Not on that alone. The FTC’s example uses a real logo and is still fake.

Should I click “unsubscribe” in a suspicious email? CISA advises not clicking any link in it, including “unsubscribe.”

Do typos mean it’s phishing? They can, but CISA says AI tools mean some phishing messages now have perfect spelling.

What if I’m not sure? Don’t use the links or numbers in the message. Go to the company’s site yourself, or call a number you know is real.

Information checked on: October 30, 2026. Scams change quickly, so check the FTC and CISA sites for current guidance.

Sources

  • FTC, How To Recognize and Avoid Phishing Scams (consumer.ftc.gov, dated September 2022 on the page)
  • CISA, Recognize and Report Phishing (cisa.gov, labelled “Archived Content” on the page)

Related stories