How to Spot Phishing Emails and Text Messages: A Practical Guide

Phishing is when someone pretends to be a trusted company, coworker, or agency to trick you into sharing private information or clicking something harmful. It usually arrives by email, but text messages (sometimes called "smishing"), phone calls, and social media messages are common too.

The good news: most phishing attempts share a handful of warning signs. Once you know them, they get much easier to notice.

Common red flags

1. Pressure to act right now

Scammers want you to react before you think. Messages might say your account will be closed, a package is stuck, or a payment failed. Real organizations do send notices, but they rarely demand that you act within minutes or threaten dramatic consequences.

2. Links that don't match

A link's visible text can say one thing while the actual destination is something else. On a computer, hover your mouse over a link (without clicking) to preview the address. On a phone, press and hold the link to see it. Look for misspellings, extra words, or strange endings, such as a bank's name followed by unrelated text in the web address.

3. Sender details that look slightly off

The display name may look right, but the actual email address may not. Watch for small changes like swapped letters, added numbers, or a free email service address claiming to represent a large company. Text messages from long, unfamiliar numbers deserve the same caution.

4. Generic greetings and odd wording

Messages that begin with "Dear customer" when the company should know your name can be a clue. Awkward phrasing, strange formatting, or logos that look blurry may also point to a fake. That said, some phishing messages are polished and well written, so don't rely on spelling mistakes alone.

5. Unexpected attachments

Be careful with attachments you weren't expecting, especially invoices, shipping documents, or "voice messages." Files can contain malicious software.

6. Requests for sensitive information

Legitimate companies generally do not ask you to send passwords, full Social Security numbers, or one-time security codes by email or text. If a message asks for any of these, treat it as suspicious.

7. Unusual payment methods

Requests to pay with gift cards, wire transfers, cryptocurrency, or payment apps are classic scam signals, especially when paired with urgency.

Safe habits that protect you

• Pause before clicking. A few seconds of doubt is your best defense.
• Verify through an official channel. Instead of using the link or phone number in the message, open the company's official app, type its web address yourself, or call the number printed on your card or statement.
• Turn on two-factor authentication (2FA). This adds a second step, like a code from an authenticator app, when you sign in. Even if someone gets your password, they usually can't get in without that second step.
• Use a password manager. It creates unique passwords for each account and often won't autofill on a fake website, which can be a helpful warning.
• Keep software updated. Updates for your phone, computer, browser, and apps fix security weaknesses.
• Never share one-time codes. If someone asks you to read a code aloud or reply with it, it's almost certainly a scam.

What to do if you suspect phishing

1. Don't reply, click, or open attachments.
2. Check with the real organization using contact details you find independently.
3. Report it. Most email apps have a "report phishing" option. For texts, you can forward spam to 7726 (SPAM) with many U.S. carriers. In the U.S., you can also report scams to the Federal Trade Commission.
4. Delete the message once you've reported it.

If you already clicked or shared something

Don't panic. It happens to careful people too. General steps that often help include:

• Change the password for the affected account, and for any other account using the same password.
• Turn on 2FA if it isn't already active.
• Contact your bank or card issuer if you shared financial details, and review recent activity.
• Run a security scan on your device if you opened an attachment or installed something.
• Consider placing a fraud alert or credit freeze if you shared sensitive identity details. The major credit bureaus explain how this works.

Specific situations vary, so for serious identity theft or financial loss, consider contacting your financial institution or a qualified professional.

A quick mental checklist

Did I expect this? Does the sender look right? Is it rushing me? Does it ask for something private or unusual? Can I confirm it another way?

If any answer makes you uneasy, step away and verify independently.

Bottom line

Phishing works by creating pressure and confusion. You can defeat it by slowing down, checking links and senders, and confirming requests through official channels you trust. Pair those habits with unique passwords and two-factor authentication, and you'll be much harder to fool, even when a message looks convincing.