What It Means
Phishing is a scam that arrives as an email or text message made to look like it came from a company you know, such as your bank, a credit card company or a utility. According to the FTC, the goal is to get your passwords, account numbers or Social Security number. The message usually tells a storyUser storyA short description of something a product should do, written from the point of view of the person who needs it, often in the form "As a, I want, so that." See more, like a billing problem or a locked account, to get you to click a link or open an attachment.
Try It: Phishing or Fine?
Four messages you didn't expect. Decide which ones to treat as phishing, using the FTC's and CISA's warning signs.
1. "Your account is on hold because of a billing problem. Click here to update your payment details."
Right. The FTC says real companies won't send a link to update payment details.Treat it as phishing. A link to fix your payment details is a classic sign.2. "Dear Customer, unusual sign-in found. Reply with your password within 24 hours or lose access."
Right. A generic greeting, a deadline and a request for your password.Treat it as phishing. Urgency plus a request for your password are warning signs.3. You typed your bank's web address yourself, signed in, and found a message about a new statement.
Right. You reached the bank through an address you know is real.This one is fine. Going to the bank yourself is what the FTC advises.4. An email with an invoice attached for something you never ordered, asking you to open it.
Right. The FTC warns attachments can install harmful software.Treat it as phishing. Unexpected attachments can carry malware.How People Say It
- "I got an email saying my account's locked, is that real?"
- "Don't click anything, call the bank on the number on your card."
- "That one's a phish, just delete it."
The Breakdown
How to handle a message you weren't expecting
- Read it for the story. The FTC says phishing messages often claim a problem with your account or your payment information, or offer something that sounds good.
- Look for CISA's warning signs: urgent or emotional wording, a request for personal or financial information, a shortened link you can't check, or an email address or link that's slightly wrong.
- Leave the links and attachments alone. The FTC warns they can install harmful software.
- If the message might be real, contact the company yourself, using a phone number or website you already know is right, never the details in the message.
- Report it to the FTC at ReportFraud.ftc.gov, then delete it.
Protect your accounts before the next one arrives
- Use security software and set it to update on its own, as the FTC suggests.
- Turn on multi-factor authentication, which asks for two or more credentials to sign in.
Short version to try today. Write down the real phone numbers for your bank and card companies, from the back of the card or a paper statement, so you never need the number in an email.
Good to Know
Real companies may email you, but the FTC says they won't email or text you a link to update your payment information. If you already answered a phishing message and a scammer has your Social Security, credit card or bank account number, the FTC points you to IdentityTheft.gov, which gives steps based on the information you lost. A credit freezeCredit freezeA free block you place on your credit report at each bureau so lenders can't read it for a new application until you lift it; also called a security freeze. See more or a fraud alertFraud alertA note on your credit report asking lenders to verify your identity before opening credit; you place it at one bureau, which must tell the other two. See more can also help after a scammer gets your details.
FAQ
What should I do if I clicked a phishing link?
If you gave out information such as a Social Security, credit card or bank account number, go to IdentityTheft.gov for steps matched to what you lost, as the FTC advises. Then contact the company through a number or website you know is real.
Is phishing only by email?
No. The FTC says scammers use both email and text messages to try to steal passwords, account numbers and Social Security numbers.
How do I report a phishing email?
Report it to the FTC at ReportFraud.ftc.gov. If it pretends to be a company you do business with, you can also contact that company through its real website or phone number.
Do It in Buhata
Household Notes
Save your bank's and card companies' real phone numbers in Household Notes in Buhata, so anyone at home checks a strange message against them.
Open BuhataRelated Terms and Categories
- Scam texts
Text messages sent by scammers, often posing as a bank, a delivery company or a prize offer, to get you to click a link, pay money or share personal details.
- Passkey
A sign-in method that replaces a password with a key stored on your phone, computer or security key, which you unlock with your face, fingerprint or screen PIN.
- Identity theft
When someone uses your name, account details or other personal information without permission to open accounts, make charges or commit other fraud.
- Credit freeze
A free block you place on your credit report at each bureau so lenders can't read it for a new application until you lift it; also called a security freeze.
Sources
Federal Trade Commission, "How To Recognize and Avoid Phishing Scams"; Cybersecurity and Infrastructure Security Agency (CISA), "Recognize and Report Phishing"; Federal Trade Commission, "How to Recognize and Report Spam Text Messages"; IdentityTheft.gov
- consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams
- www.cisa.gov/secure-our-world/recognize-and-report-phishing
- consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages
Last updated .