How to spot phishing emails and texts (and what to do if you clicked)

Phishing is a message that pretends to come from someone you trust so you will hand over a password, a payment, or access to your device. The brands change. The structure barely does.

• A trusted name. Your bank, Amazon, the Postal Service, Microsoft, your boss, the state toll agency.
• A problem or a prize. A failed delivery, a suspended account, an unpaid toll, an unexpected charge, a refund waiting for you.
• Urgency. Act within 24 hours, or the account closes, the package goes back, a late fee applies.
• One easy action. Click this link, scan this code, call this number, open this attachment.

Once you know the shape, you start to see it everywhere. Any message that combines a scare with a shortcut deserves a second look, however official it seems.

Package delivery problems

"Your USPS package could not be delivered due to an incomplete address." These arrive by text and email and link to a page asking for a small redelivery fee. The point is your card number. USPS does not text you about a package unless you signed up for tracking alerts for that specific number.

Unpaid toll texts

A text says you owe a small amount for an unpaid toll and will face fines if you do not pay today. The FBI and the FTC have both warned about this wave of smishing (phishing by SMS). It works because the amount is small and plausible. If you think you might owe a toll, go to your toll agency's site or app directly.

Fake invoices and PayPal charges

An invoice for software you never bought, or a PayPal notice of a large payment, with a phone number to call if you want to dispute it. The person who answers is the scammer. They may ask you to install remote access software "to process the refund." Some of these are sent through real invoicing tools, so they come from a genuine company address. Check your PayPal account by opening the app, never by calling the number on the invoice.

Microsoft 365 and work logins

"You have 3 pending messages," "Your password expires today," or a shared document that needs you to sign in. The link leads to a near-perfect copy of the Microsoft login page. These are aimed at work accounts because one stolen login can open up a whole company. Our guide to business email compromise covers what happens next.

"Your account will be suspended"

Netflix, Apple, your bank or your email provider says there is a billing problem or suspicious sign-in and you must verify your details. Real companies do send security alerts, but you can always check them by opening the app yourself.

QR codes (quishing)

A QR code in an email, on a letter, or stuck over the real one on a parking meter. Scammers use codes because your phone hides the full address, and because email filters have a harder time reading an image. Before you open a scanned link, read the web address your camera shows you. For parking, use the city's official app or pay at the machine.

Messages written by AI

The old advice to look for bad grammar is out of date. Generative AI lets scammers write fluent, polite, well-formatted messages in any language, and personalize them using details from your public profiles or a past data breach. Judge the request, not the writing.

The sender

The display name means nothing. Anyone can call themselves "Chase Fraud Department." Tap or hover on the name to see the real address. Watch for:

• Free webmail addresses claiming to be a company (paypal.support.team@gmail.com).
• Lookalike domains: amaz0n.com, micros0ft-security.com, chase-alerts.net, or the real brand buried in a longer name like paypal.com.account-review.co.
• A reply-to address that differs from the sender. You can see it by starting a reply and looking at the To field.

The link

On a computer, hover over the link and read the address in the corner of the browser window. On a phone, press and hold the link to preview it without opening it. What matters is the part just before the first single slash. In https://login.microsoftonline.com.secure-check.io/verify, the real domain is secure-check.io, not Microsoft.

Shortened links (bit.ly and similar) hide the destination, and legitimate banks rarely use them in alerts. Treat them as unverified.

Attachments

Be wary of unexpected attachments, especially ZIP files, HTML files, and Office documents that ask you to "enable content" or "enable macros." An HTML attachment that opens a login page is a common trick to get past filters.

Clicking a link on its own is usually not a disaster. The damage comes from what you typed or installed afterward. Work out which case you are in.

You entered a password

1. Change that password right away, from the real site or app.
2. Change it anywhere else you used the same password. This is the step people skip.
3. Turn on two-factor authentication, ideally a passkey or an authenticator app.
4. Check the account for changes: recovery email and phone, forwarding rules (a favorite trick in hijacked email accounts), connected apps and recent sign-ins. Sign out other sessions.

You entered card or bank details

Call the number on the back of your card and ask for the card to be canceled and reissued. Watch your statements. If you gave your Social Security number, a free credit freeze at all three bureaus stops new accounts being opened in your name.

You downloaded something or allowed remote access

Disconnect from the internet, uninstall any remote access app you were told to install, and run a full scan with your security software. On Windows, the built-in Microsoft Defender is a fine place to start. Then change your important passwords from a different, clean device. If a scammer had control of your computer for a while, consider having it checked or reset. See is free antivirus enough and how to tell if your phone is hacked.

You lost money

Call your bank or card issuer immediately, because speed matters for getting funds recalled. Then report it to the FBI at IC3.gov and the FTC at ReportFraud.ftc.gov. If your identity was used, go to IdentityTheft.gov for a recovery plan, and read our identity theft guide.

Reporting takes a minute and helps filters catch the next batch. None of it costs anything.

• Email: use the Report phishing or Report button in your mail app (Gmail, Outlook and Apple Mail all have one), then forward the message to the Anti-Phishing Working Group at reportphishing@apwg.org.
• Texts: forward the text to 7726 (it spells SPAM). The major US carriers use these reports to block senders. On iPhone and Android you can also tap Report Junk or Report spam.
• Impersonated companies: many brands take reports directly. PayPal, Amazon, Microsoft and the big banks all publish an address or form for phishing reports on their security pages.
• Any scam, especially if you lost money: ReportFraud.ftc.gov.

Then delete the message. Do not reply, even to say stop, because a reply confirms your address is live.

A few changes make phishing much less likely to cost you anything, even on a day you are tired and click the wrong thing.

• Use passkeys where offered. A passkey cannot be typed into a fake site, so it defeats the classic login-page trick.
• Use unique passwords stored in a password manager, so one stolen login stays one stolen login.
• Use an email alias for shopping and sign-ups. When a "your order" message arrives at an alias you never gave that store, you know it is fake. Our email aliases guide explains how.
• Keep your devices updated so a malicious attachment has fewer holes to use. See keeping your devices updated.
• Agree a family rule that nobody sends money or codes based on a text or call alone, no matter how urgent or who it claims to be. Call back on a known number.

Most browsers and email services already include phishing filters, and they catch a large share of the obvious stuff. Paid security suites add web protection on top. That can help on a family computer, but it cannot stop you from typing a password into a page you chose to trust.