Phishing 101: How to Spot Scam Emails, Texts, and DMs

Phishing is a form of social engineering: someone sends a message designed to persuade you to reveal information, send money, install software, or take another action that benefits the sender. It can arrive by email, SMS, social media, messaging apps, or even a QR code.

Modern phishing is not always full of spelling mistakes or obvious promises of unexpected riches. A suspicious message may look polished, mention a company you actually use, or appear in the same conversation thread as legitimate messages. Generative AI also makes writing polished messages easier, so grammar alone is a weak test.

Fortunately, you do not have to become an expert at identifying every fake. One of the most useful defenses is independent verification: when a message says something important has happened, do not let that same message decide how you verify the claim. Open the company’s official app, use a saved bookmark, type a known website address yourself, or call a number you independently trust.

This guide explains how to spot phishing, recognize common phishing red flags, handle smishing text scams and suspicious links, evaluate fake login pages, and report phishing in the United States.

Quick Takeaways

• Treat unexpected requests for passwords, one-time codes, payments, personal information, downloads, or urgent account action cautiously.
• Do not rely on a sender’s display name, logo, writing quality, or caller ID alone to prove identity.
• Instead of using an unexpected message’s link, open the organization’s official app or independently navigate to its website.
• Never give an unsolicited caller or message sender a one-time authentication code.
• A suspicious link is safer to leave unopened; if you need to check an account, go there independently.
• Multifactor authentication reduces the risk from stolen passwords but is not perfect; phishing-resistant options such as passkeys can provide stronger protection when properly supported.
• If you clicked a suspicious link but entered nothing, the next steps are usually different from what you should do after submitting a password or payment information.
• Use your email, phone, carrier, or platform’s reporting tools and report appropriate scams to the FTC at ReportFraud.ftc.gov.

What Is Phishing?

Phishing is an attempt to manipulate someone into taking an action under false pretenses.

The sender might pretend to represent:

• A bank or credit-card issuer
• A delivery company
• A government agency
• An employer or coworker
• A streaming or shopping service
• A social media platform
• A technology company
• A school or university
• A friend or relative
• A prospective employer

The message may claim your account has been locked, a package cannot be delivered, a payment failed, your password expired, or unusual activity occurred.

Sometimes the claim might even happen to correspond with something real. You could receive a fake delivery message while genuinely waiting for a package. Coincidences like that can make phishing more convincing.

The safest response is not to determine whether the story sounds plausible. Verify the story through a separate, trustworthy channel.

Phishing, Smishing, Spear Phishing, and Other Terms

Cybersecurity terminology can sound more complicated than the underlying concepts.

“Phishing” is the broad category. “Smishing” generally means phishing delivered through SMS or other text messages. “Vishing” refers to voice-based phishing, often involving phone calls.

Spear phishing is more targeted. Instead of sending the same generic lure to many people, a sender may tailor a message to a particular person, employer, job role, or situation.

For example, an employee might receive an unexpected message apparently from a manager requesting an unusual payment. A college student could receive a message mentioning the university they actually attend.

Personalization makes a message more believable; it does not make it authentic.

Common Phishing Red Flags

No single red flag proves that a message is fraudulent. Legitimate companies sometimes send urgent notices, and genuine emails can contain imperfect grammar.

Instead, look at the combination of context, request, sender, and verification method.

Potential red flag	Example	Safer response
Unexpected urgency	“Act within 30 minutes”	Check the account independently
Password request	“Reply with your password”	Never send it; use the official service
Verification-code request	“Tell us the code you just received”	Do not share authentication codes
Unexpected payment request	“Pay this invoice today”	Confirm through an established channel
Gift cards/crypto requested	“Buy cards and send the codes”	Stop and independently verify
Suspicious login link	“Verify your account here”	Open the official app/site yourself
Unexpected attachment	“Review attached invoice”	Verify the sender before opening
Unusual sender address	Familiar display name, unrelated address	Inspect sender information
Personal information requested	“Confirm your SSN and date of birth”	Verify the organization independently
Unexpected QR code	“Scan to avoid account suspension”	Treat like any other unverified link

A message can also be fraudulent without displaying all—or even most—of these signs.

1. Start With the Request, Not the Logo

Logos and professional design are easy to reproduce. The more useful question is:

What is this message asking me to do?

Pay special attention if an unexpected message asks you to:

• Enter a password
• Approve a sign-in
• Provide a one-time code
• Send money
• Change payment instructions
• Buy gift cards
• Transfer cryptocurrency
• Download software
• Install an app or browser extension
• Give someone remote access
• Provide sensitive personal information

These requests are not always illegitimate. Your real bank, employer, or service provider may sometimes need you to take account-related action.

The difference is that you can verify the request without relying on the contact information or link contained in the unexpected message.

2. Be Careful With Urgency and Pressure

Phishing frequently creates artificial urgency.

The message may claim:

“Your account will close today.”

“Payment must be made immediately.”

“Your package will be returned.”

“Respond before your manager enters a meeting.”

“This is your final security warning.”

Urgency matters because it can discourage independent verification.

If a legitimate account actually needs attention, you should normally be able to find the same relevant information by opening the provider’s official app or independently navigating to your account.

Take the time necessary to verify important requests.

3. Check the Sender—but Don’t Stop There

A familiar display name does not establish that a message came from the person or company named.

Email applications typically display a friendly sender name prominently, while the underlying address may receive less attention.

Expand the sender details if needed and check the complete email address.

Ask:

Does the domain match the organization I expected?

Is the message coming from an unrelated address?

Does the reply-to information look unusual?

That can identify some phishing attempts, but it is not a perfect test. Email infrastructure is complicated, legitimate businesses can use outside service providers, and account compromise can sometimes allow deceptive messages to originate from a real account.

For important requests, independent verification remains stronger than visual inspection.

4. Learn How to Handle Suspicious Links

Links are a common phishing mechanism because they can direct you to fake login pages or unwanted downloads.

If you do not need to open a questionable link, do not open it simply to investigate.

Instead, navigate to the organization’s site independently.

On a computer

Desktop browsers and email applications may display a destination when you hover your pointer over a link without clicking it.

That can help reveal obvious mismatches, but it should not be your only safety test. Long URLs can be difficult to interpret, redirects can complicate destinations, and a malicious domain may still look plausible.

For important accounts, open a saved bookmark or type the known address yourself.

On iPhone or Android

Pressing and holding a link may show a preview or destination in many apps. Interface behavior varies, however, and opening previews unnecessarily is not required.

The safer option is often simply not to interact with the suspicious link.

Open your bank, retailer, carrier, email provider, or other service through its official app or a known website instead.

5. Understand Fake Login Pages

A fake login page imitates a real service’s sign-in screen to collect information entered into it.

It may contain a convincing logo, familiar fonts, password fields, and even links to genuine privacy policies.

Appearance does not prove ownership.

Check the actual web address

Before entering credentials, inspect the browser’s address bar.

HTTPS is useful because it encrypts your connection to the website. It does not prove that the website belongs to the company it claims to represent. A deceptive website can also use HTTPS.

The domain matters.

Rather than trying to decode a confusing address while under pressure, close the page and navigate to the real service independently.

Your password manager can provide another signal

Password managers normally associate saved credentials with specific websites.

If your password manager usually fills credentials for a service but suddenly does not recognize a login page, inspect the website carefully rather than manually typing your password.

This can be a useful warning signal, although it is not an absolute guarantee either way.

6. Watch for One-Time Code and Sign-In Approval Requests

Multifactor authentication, or MFA, adds an extra authentication step beyond a password.

It substantially improves account security in many situations, but attackers can sometimes try to persuade users to hand over the second factor too.

If someone unexpectedly asks you to read back a code sent by text, email, or an authentication app, do not provide it.

Likewise, do not approve an unexpected sign-in notification simply because repeated prompts are annoying.

If you receive a sign-in prompt you did not initiate, deny it when the service gives you that option and independently review your account security.

Passkeys and phishing resistance

Passkeys use public-key cryptography and are designed to provide stronger resistance to conventional credential phishing because authentication is tied to the legitimate service.

They do not eliminate every possible account-security risk. Recovery processes, device security, and social engineering still matter.

Where major services support passkeys, they can be worth considering.

7. Spot Smishing Text Scams

Smishing text scams use the same social engineering principles as email phishing, but mobile interfaces create additional challenges.

A text may say:

“USPS: Your package cannot be delivered.”

“Unusual account charge detected.”

“Your toll payment is overdue.”

“Your streaming subscription was suspended.”

“You have an unpaid invoice.”

Do not assume a message is genuine because it arrives in the same thread as previous texts or appears to use a familiar sender label.

Delivery messages

If you are waiting for a package and receive an unexpected problem notice, open the retailer or carrier’s official app or website independently.

Use a tracking number you already received from your purchase confirmation if appropriate.

Do not submit payment information just because an unexpected text says a small “redelivery fee” is due.

Bank and payment messages

Financial institutions may legitimately send fraud alerts. A message itself should not be your only source for deciding how to respond.

If you are unsure, use the official bank app, type the bank’s known web address yourself, or call the number printed on your card.

Never rely exclusively on the number contained in a suspicious text.

8. Be Cautious With Social Media and Messaging DMs

Phishing also occurs through Instagram, Facebook, LinkedIn, Discord, WhatsApp, Telegram, and other platforms.

A suspicious direct message might claim:

• Your account is about to be deleted.
• You violated a copyright policy.
• You won a prize.
• A friend needs emergency money.
• A recruiter has an unusual job opportunity.
• Someone needs you to vote in a contest.
• You must verify your account through a supplied link.

If a friend sends an unusual request, confirm it through another method you already use to communicate.

Their account could have been compromised—or they may simply have sent something unexpected. Verification resolves the uncertainty without making assumptions.

9. Treat QR Codes Like Links

A QR code can encode a web address.

Scanning it is convenient, but the code itself does not tell you whether the destination is trustworthy.

Be cautious when a QR code arrives in an unexpected email or message and claims you must scan it to secure an account, review a document, or prevent a suspension.

For account-security notices, use the official app or independently navigate to the website instead.

In public places, also be aware that a physical QR code could potentially be replaced or covered. Check the destination your phone displays before proceeding.

10. Be Careful With Attachments

Not every phishing campaign uses a link. Some messages deliver unwanted files through attachments.

Unexpected invoices, shipping documents, resumes, shared files, or other attachments deserve verification when you were not expecting them.

Avoid opening an unexpected attachment merely to discover what it contains.

If the email appears to come from someone you know, contact them through an established channel and ask whether they sent it.

Keep Windows, macOS, your browser, office/document software, and security protections updated. Updates can reduce risk if software encounters malicious content.

11. Spear Phishing: When the Message Knows Something About You

Spear phishing can be more difficult to identify because the sender uses relevant details.

A message may mention:

• Your full name
• Employer
• Job title
• College
• Coworker
• Recent conference
• A public professional project

Much of this information may be publicly available through company websites, social media, professional networking profiles, and other sources.

Knowing accurate information about you does not prove the sender’s identity.

Workplace requests deserve particular care

A message apparently from a manager might ask an employee to purchase gift cards, change payment details, send sensitive documents, or urgently authorize a transaction.

Organizations should have established processes for sensitive requests. Use those processes rather than relying only on email.

For example, confirm unusual financial instructions using a known internal number or another established communication channel.

Do not reply to the potentially suspicious message asking, “Is this really you?” That keeps the verification inside the same possibly untrustworthy channel.

12. Job and Recruitment Phishing

Job seekers may receive genuine unsolicited outreach, so a message from someone you do not know is not automatically a scam.

Be more cautious when a supposed employer asks for sensitive information unusually early, sends an unexpected check, requests that you buy equipment and send money elsewhere, or moves immediately to unusual payment arrangements.

Research the company independently.

Visit its official careers page and use independently sourced contact information to verify the role when necessary.

Personal data legitimately needed for employment should be handled through appropriate, established onboarding systems, not casually submitted to an unknown person because of an unsolicited message.

13. Government and Tax-Themed Messages

Messages may claim to come from federal, state, or local agencies.

Government procedures vary, so avoid relying on simplistic rules such as “a government agency will never text” or “the IRS only communicates one way.” Agencies can have multiple legitimate communication channels depending on the program and circumstances.

The stronger rule is independent verification.

For an IRS-related message, for example, navigate independently to IRS.gov rather than using an unexpected message’s link. For Social Security matters, use SSA.gov and the agency’s official contact channels.

Look up government websites yourself. In the United States, .gov domains are restricted to verified government entities, making them useful for identifying official sites, though you should still type or select the correct domain carefully.

14. Phishing Can Also Arrive by Phone

Voice phishing, or vishing, can involve callers impersonating banks, government agencies, technical support, or companies.

Caller ID is useful, but it should not be treated as proof of identity.

If a caller says they represent your bank and need urgent action, end the call and contact the bank using the number printed on your card or its official website.

Do not disclose passwords or one-time authentication codes to an unexpected caller.

A legitimate fraud investigation can be handled using independently verified contact information.

A Safe Way to Handle Any Unexpected Security Message

You do not need to prove that a message is phishing before treating it cautiously.

Use this defensive process:

1. Stop before clicking links, opening attachments, calling numbers, or replying.
2. Identify exactly what the message is asking you to do.
3. If it concerns an account, open that service’s official app or independently navigate to its known website.
4. Check whether the claimed problem appears in your real account.
5. For an unusual request from a person, confirm through a separate communication channel.
6. If the original message was phishing or unwanted, use the platform’s reporting and blocking tools.
7. Delete the message after reporting it unless you need to retain a copy for an employer, financial institution, law enforcement, or another appropriate reason.

This approach works even when the phishing message itself is exceptionally convincing.

How to Report Phishing

Reporting can help providers identify abusive accounts, domains, phone numbers, or campaigns.

Email

Major email providers such as Gmail and Outlook include “Report phishing” or similar controls. Use the provider’s built-in reporting option when available rather than simply replying to the sender.

For a work account, follow your organization’s security-reporting procedure.

Text messages

Your phone’s Messages app or carrier may provide “Report Junk,” “Report spam,” or similar options.

In the United States, the FTC also notes that consumers can forward many unwanted text messages to 7726 (SPAM), which participating wireless carriers use for spam reporting. Carrier procedures can vary.

FTC reporting

You can report fraud and scams to the Federal Trade Commission at:

https://ReportFraud.ftc.gov

FTC reporting is separate from recovering an affected account or disputing a financial transaction, so take those steps independently where necessary.

Government impersonation

For scams impersonating particular agencies, use reporting instructions published by the actual agency. Navigate to its official .gov website independently rather than using a link supplied in the suspicious message.

What to Do If You Clicked a Suspicious Link

Clicking a questionable link does not automatically mean your device or account has been compromised.

What happened after the click matters.

If you opened the page but did not enter information or download anything:

1. Close the page.
2. Do not return simply to inspect it.
3. Update the browser and operating system if updates are available.
4. Check whether you granted the site notification, download, or other permissions.
5. Remove permissions you did not intend to grant.
6. If you have a specific reason to suspect unwanted software, use the security tools built into your device or reputable security software.

Do not install a “cleanup” application advertised by the suspicious site itself.

What to Do If You Entered Your Password

If you submitted a password to a suspicious page, treat the password as potentially exposed.

From a device you trust:

1. Navigate directly to the legitimate service.
2. Change the affected password.
3. Replace that password anywhere else you reused it.
4. Review recent sign-ins or active sessions if the service provides them.
5. Sign out unfamiliar sessions where appropriate.
6. Review recovery email addresses and phone numbers.
7. Enable available MFA or a passkey.

If the affected credential belongs to your email account, prioritize it because email is often involved in password recovery for other accounts.

If it is a work or school account, notify the appropriate IT or security team promptly.

What to Do If You Shared a One-Time Code

A one-time code may authorize a login, account recovery, or transaction.

If you gave one to an unexpected person, go directly to the corresponding account and review its security activity. Change affected credentials where appropriate and check trusted devices and recovery settings.

Contact the provider through its official support process if you cannot confirm that the account remains secure.

Do not continue communicating with the person who requested the code simply because they claim they can reverse the situation.

What to Do If You Downloaded or Installed Something

Downloading a file does not always mean it ran.

If a suspicious file downloaded but you did not open it, delete it if you cannot verify it.

If you opened or installed unfamiliar software, update your operating system and security tools, review recently installed applications and browser extensions, and perform an appropriate security scan.

On Windows, use Windows Security/Microsoft Defender or another reputable security product you already trust.

On Mac, keep macOS updated so built-in protections such as XProtect can receive applicable updates. Review installed applications and relevant Privacy & Security permissions.

On Android, review recently installed apps and use supported Google Play Protect features where available.

On iPhone or iPad, update iOS/iPadOS and review installed apps, notification permissions, and device-management settings if relevant.

Avoid deleting obscure operating-system files based solely on generic internet advice.

What to Do If You Sent Money or Payment Information

If a phishing incident involved a credit card, bank account, or other financial service, contact the financial institution promptly using the number on your card, statement, or independently verified official website.

Tell the institution what happened and follow its fraud procedures.

Do not use a phone number supplied by the suspicious message.

For payment apps or other services, use the provider’s official support and transaction-reporting tools as well.

If personal information may have been misused for identity theft in the United States, FTC IdentityTheft.gov provides official recovery information. This article is general cybersecurity information, not legal or financial advice.

Strengthen Accounts Before Phishing Happens

Some defensive measures make phishing less damaging.

Use unique passwords so one exposed credential does not unlock unrelated accounts. A reputable password manager can make this much easier.

Enable MFA on important accounts. CISA recommends MFA because it provides additional protection when a password is compromised.

When a trustworthy service supports phishing-resistant authentication such as passkeys or appropriate security keys, consider using it.

Keep operating systems, browsers, messaging apps, and security software updated.

Finally, make account recovery part of security. Keep recovery email addresses and phone numbers current and securely store recovery codes where appropriate.

Common Mistakes to Avoid

Do not assume poor spelling is the defining feature of phishing. Well-written scam messages exist, and generative AI has made polished text easier to produce.

Avoid trusting a message solely because it includes your name, address, employer, or other correct personal information. Such information may be publicly available or obtained from previous data exposures.

Do not trust caller ID, a display name, logo, HTTPS connection, or familiar-looking sign-in screen by itself.

Avoid using the suspicious message’s own phone number to confirm whether the message is legitimate. Find the organization independently.

Do not share one-time authentication codes with unexpected callers or message senders.

Avoid replying to a questionable sender merely to ask whether the message is genuine. Verify through another channel instead.

Do not automatically assume that clicking a suspicious link means you have been hacked. Assess what happened afterward and take proportionate defensive steps.

Finally, do not be embarrassed into hiding an incident. If a work account, financial account, or sensitive personal information might be involved, timely reporting to the appropriate organization can matter.

FAQ

What is the easiest way to spot phishing?

Focus on what the message wants you to do rather than how polished it looks.

Unexpected requests involving credentials, authentication codes, payments, downloads, or sensitive information deserve independent verification. Instead of following the message’s instructions, open the real service yourself.

Can phishing emails look completely legitimate?

Yes. Some phishing messages use professional writing, accurate personal information, familiar branding, and plausible situations.

Visual quality is therefore not a reliable authentication method.

What is smishing?

Smishing is phishing delivered through SMS or similar text messaging.

Common themes include delivery problems, unpaid tolls, account alerts, subscription problems, and financial warnings. Independently open the claimed service rather than following the text’s link.

What is spear phishing?

Spear phishing is a more targeted phishing attempt tailored to a particular person, organization, or role.

The sender might use your employer, job title, coworker’s name, or another accurate detail to make the request seem more believable.

Is it safe to click a link just to see where it goes?

It is generally unnecessary. If you suspect the link may be deceptive, avoid opening it.

For an account-related message, navigate to the organization’s official app or website independently.

Does HTTPS mean a login page is genuine?

No. HTTPS means the connection between your browser and that website is encrypted when functioning properly.

A fraudulent website can also use HTTPS. Confirm that you are at the correct domain before entering sensitive information.

What if I clicked a phishing link but entered nothing?

A click alone does not prove that your account or device was compromised.

Close the site, check for unintended downloads or permissions, update your browser and device, and use reputable security tools if there is a specific reason for concern.

If you entered credentials or installed software, additional steps are appropriate.

Does two-factor authentication stop phishing?

It reduces risk but does not stop every form of phishing. Someone may attempt to steal both a password and a temporary authentication code or persuade a user to approve an unexpected login.

Phishing-resistant methods such as properly implemented passkeys and security keys can offer stronger protection in supported situations.

Where should I report a phishing text?

Use the spam-reporting feature provided by your Messages app or carrier. In the US, many carriers support forwarding spam texts to 7726 (SPAM).

Fraud can also be reported to the FTC at ReportFraud.ftc.gov.

Should I change all my passwords after receiving a phishing email?

Simply receiving a phishing message is not usually a reason to change every password.

If you submitted a password, change that credential and any other accounts where you reused it. If you did not interact with the message, reporting and deleting it may be sufficient.

When to Get Extra Help

If you suspect an important account has been accessed, use the provider’s official security and account-recovery channels from a device you trust. Google, Microsoft, Apple, social networks, and other providers maintain their own recovery procedures.

For an employer or school account, contact the organization’s IT or security team. Follow its incident-reporting process even if you are not certain that an account was compromised.

If banking, credit-card, or payment information was involved, contact the financial institution using the number on your card, statement, official app, or verified website. Do not rely on contact details provided in the suspicious message.

For possible identity theft in the United States, use the Federal Trade Commission’s official recovery site at IdentityTheft.gov. This is general cybersecurity information, not legal or financial advice.

If a situation includes credible threats, extortion, stalking, or potentially criminal activity, consider contacting the appropriate local or federal authorities. Preserve relevant messages and transaction records if it is safe to do so.

A Simple Phishing Checklist

You do not need to perfectly identify every scam email, text, or DM. You need a reliable way to respond when a message could be deceptive.

Remember the core checklist: pause on unexpected requests for passwords, verification codes, payments, downloads, or personal information; avoid suspicious links; check accounts through official apps or independently entered web addresses; verify unusual requests through a different channel; and report phishing through the appropriate platform.

If you already interacted with a suspicious message, match your response to what happened. Clicking without entering anything is different from sharing a password, approving a sign-in, installing software, or sending money.

The most useful habit is independent verification. An unexpected message can tell you that something needs attention, but it does not need to control how you check whether that claim is true.