Phishing emails are built to make you act before you think. Knowing the usual tricks gives you the moment you need.
TL;DR
- Phishing emails usually tell a story that pushes you to click a link or open an attachment.
- Check a suspicious message by contacting the company through a website or phone number you already know.
- Forward phishing emails to reportphishing@apwg.org and report them to the FTC at ReportFraud.ftc.gov.
A phishing email pretends to come from someone you trust, such as a bank, a delivery company, a streaming service or your own employer, to get you to hand over passwords, money or personal details.
What do phishing emails have in common?
According to the Federal Trade Commission, phishing messages often tell a story to get you to click a link or open an attachment. Common stories include:
- suspicious activity or a login attempt on your account
- a problem with a payment, order or delivery
- a request to confirm personal or financial information
- an invoice you don’t recognize
- a refund, prize or coupon you didn’t expect
Look for a generic greeting, pressure to act quickly, and a link or attachment that does the real work.
Heads up
The FTC’s rule of thumb: legitimate companies won’t email you a link to update your payment information. If a message asks for that, treat it as a scam until you’ve proved otherwise.
How do you check a message safely?
Ask yourself: do I have an account with this company, or do I know this person?
- If not, it’s probably phishing. Report it and delete it.
- If yes, don’t use the links or phone numbers in the email. Go to the company’s website by typing the address yourself, use its app, or call a number you already have.
On a computer, you can hover over a link to see where it really goes. A link that says one thing and points somewhere else is a red flag, though a clean-looking link isn’t proof of safety.
Where should you report it?
- Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.
- Report the attempt to the FTC at ReportFraud.ftc.gov.
- If the email pretends to be from your employer or your bank, tell them too. Many have their own reporting address.
- Use your email provider’s “report phishing” or “report spam” option.
What if you already clicked?
- If you entered a password, change it right away, and change it anywhere else you used it. See what to do if your email is hacked.
- If you downloaded something, update your security software, run a scan and remove anything it flags.
- If you gave out financial or personal details, such as a card or Social Security number, go to IdentityTheft.gov for a recovery plan.
How can you make phishing less effective?
Turn on multi-factor authentication, so a stolen password isn’t enough to get into your account, and keep your devices updated and backed up. Our guide to locking down your email account walks through the settings.
Quick answers
Q: Can a phishing email come from an address I know?
A: Yes. Scammers can fake the sender’s name, and sometimes they send from a real account they’ve broken into. Judge the request, not just the sender.
Q: Is it dangerous just to open a phishing email?
A: Opening it is usually low risk. The danger comes from clicking links, opening attachments, replying or entering information.
Q: What about phishing texts?
A: Forward them to 7726 (SPAM), which reports them to your mobile carrier, and report them to the FTC as well.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
