Phishing scams use deceptive communications to obtain information or lead someone into a harmful action. A message might imitate a bank, retailer, employer, or government office and request a login, payment, or attachment download. The FTC recommends checking unexpected requests through a known website or telephone number. Open the genuine service independently before providing credentials or financial information.
The first response to phishing scams is to pause the requested action and check the underlying claim outside the message. An apparent billing error, blocked account, or suspicious login can be invented to create urgency. Compare it with the real account or organization. A familiar logo, accurate name, or professional appearance requires independent verification of the sender and linked page.
How phishing scams disguise the source
The FBI explains that spoofing can alter an email address, sender name, phone number, or website address to resemble a trusted source. Small changes in a domain can be easy to overlook. Examine the actual address and destination, not the visible display name. A copied message header means the request should be verified through the genuine organization.
Phishing can also arrive through text messages or voice contact. The FBI distinguishes smishing through SMS from vishing through telephone or internet voice services. The channel changes, but the check remains practical: independently identify the organization and confirm the request. A caller transferring someone to another supposed department is not a substitute for contacting the real institution separately.
False login pages and harmful attachments
Phishing scams often claim that account information must be verified or a payment issue corrected. A linked page may imitate the real bank or service while collecting passwords and account details. The FTC warns that links and attachments can also install harmful software. Do not test a suspicious link by entering credentials or downloading the file to see what happens.
Multifactor authentication adds another credential check beyond a password, and the FTC recommends enabling it where available. Keep device software and security tools updated and maintain backups. Those protections reduce risk, so independently verify each unexpected message. Continue checking unexpected requests independently, especially when someone asks for a code or tries to disable an existing account safeguard.
- Check requests through independently obtained contact details.
- Keep passwords and authentication codes private.
- Forward suspicious texts to 7726 and report phishing to the FTC.
Reporting phishing scams and documenting exposure
The FTC directs phishing emails to [email protected] and suspicious text messages to 7726. It also accepts reports at ReportFraud.ftc.gov, while the FBI accepts online crime reports through IC3. Preserve the sender details and message before reporting. Describe whether the link was opened, information was entered, a file was downloaded, or money was sent, because those are different exposures.
After phishing scams expose information, respond to the specific account and data involved. Use the genuine provider to change compromised credentials and contact the bank about financial exposure. If a download installed harmful software, the FTC recommends updating security software, scanning, and removing identified problems. A suspicious message alone should not lead to more downloads from a stranger offering cleanup.
What to do after phishing contact
If a phishing link led to money being transferred, notify the payment provider immediately and ask about reversing the transaction, as the FTC recommends. Explain whether the recipient entered payment details, approved a deceptive request, or lost account access. Use the institution’s genuine app or card number; the contact details embedded in the phishing message should not guide this conversation.
Preserve the phishing message, sender address, destination URL, and time credentials or payment information were entered. Pair these with any resulting transaction reference. The reporting guide helps show the sequence from lure to account exposure, giving the bank a clearer basis for identifying affected payments than a screenshot that omits the link and the action it requested.
For a password submitted through a phishing page, open the genuine service independently and replace that credential, plus any reused copies. FTC guidance also recommends multifactor authentication. If identity information was misused, follow IdentityTheft.gov. Apply the phone-checking guide to later calls claiming the compromised account requires another login, security code, or payment to restore normal access.
Reporting phishing losses and recovery demands
Report the deceptive message and its linked website at ReportFraud.ftc.gov; online theft can also be described through IC3.gov. Include the organization impersonated, URL supplied, information entered, and resulting transfers. Save a report copy with the phishing evidence, while separately asking the financial institution to address exposed accounts and money moved rather than waiting for an investigative response.
A later message offering to recover phishing losses can itself seek credentials, documents, or another payment. IC3 says private businesses do not partner with it for fund recovery. Consult the recovery-scam guide and verify claimed official assistance through an independently located agency website before responding. Knowledge of the compromised account does not establish the sender’s authority to retrieve its money.
Companies and numbers checked in this category
Questions and answers
What is the difference between spoofing and phishing?
The FBI describes spoofing as disguising a sender, phone number, or website address to appear trustworthy. Phishing uses deceptive communications to obtain information or prompt harmful actions. Spoofing can make a phishing message look as though it came from a familiar source.
Can phishing arrive by telephone or text?
Yes. The FBI describes smishing through SMS texts and vishing through voice calls. Both can seek sensitive information or financial action. Verify an unexpected request through the genuine organization using independently obtained contact details, regardless of how the message arrived.
Where should a phishing email be forwarded?
The FTC directs phishing emails to [email protected] and suspicious texts to 7726. It also accepts fraud reports at ReportFraud.ftc.gov. Retain sender details and explain whether information was entered, a file downloaded, or money sent through the suspicious contact.
Does multifactor authentication replace message checking?
The FTC recommends multifactor authentication as an added protection because access requires more than a password. It does not establish that a sender or link is genuine. Continue to verify unexpected requests independently and keep authentication codes out of conversations with other people.
What if a phishing message caused a payment to a fake invoice?
Notify the company used to make payment immediately, giving the invoice message, recipient, and transaction reference. FTC recovery advice recommends asking for reversal after deception. Preserve the phishing email or text separately so reporting can explain both the false request and the money sent.
What evidence helps IC3 assess a phishing-related loss?
Include the sender address or telephone number, destination link, impersonated organization, and transaction details in an internet-crime report. IC3 collects reports about cyber-enabled crime. Preserve the original message and identify whether the recipient entered credentials, downloaded a file, or approved a payment after following it.
What if a password was entered on a phishing login page?
Open the real provider independently to change that password and any reused versions. The FTC recommends multifactor authentication and account recovery when access is lost. Save the fraudulent login address as evidence, but do not use the suspicious message to return to the affected account.
Can a private phishing-recovery company claim authority from IC3?
IC3 says it does not collaborate with private firms to recover funds or investigate cases. A company advertising that relationship after a phishing incident should therefore be checked independently. Secure the affected account through its actual provider and ask the payment company about any lost transaction.
Sources
- How To Recognize and Avoid Phishing Scams · Federal Trade Commission
- Spoofing and Phishing · Federal Bureau of Investigation
- How To Avoid a Scam · Federal Trade Commission
- What To Do if You Were Scammed · Federal Trade Commission
- Internet Crime Complaint Center · Federal Bureau of Investigation