Phishing is the practice of impersonating a trusted entity — your bank, the IRS, a retailer — to trick you into revealing personal or financial information. It's called "phishing" because attackers cast wide nets, hoping some percentage of recipients will take the bait.
Modern phishing has evolved far beyond the obvious, typo-filled emails of the past. AI tools can help scammers create more polished or personalized messages, making spelling and grammar alone less reliable as warning signs.
The Three Main Forms
Phishing (Email)
Email phishing sends fraudulent messages designed to look like they come from legitimate sources. Common impersonation targets: your bank, PayPal, Amazon, the IRS, Social Security Administration, Medicare, and package delivery services.
How to identify email phishing:
- •Unexpected messages about accounts or activity you don't recognize
- •The email creates urgency: "Your account will be suspended in 24 hours" or "Immediate action required"
- •The sender's email address or links may not match the company's official domain (suspicious domains and shortened URLs can be warning signs, but are not proof by themselves that a message is fraudulent)
- •The email asks you to confirm personal information, passwords, or full account numbers
- •It includes unexpected attachments
Smishing (SMS/Text)
Smishing uses text messages instead of email. Common forms include fake package delivery notifications ("Your package could not be delivered — click here"), bank fraud alerts, and government benefit notifications.
Text messages feel more urgent than email — they arrive on your phone, they're short, and the instinct is to respond quickly. This is exactly what fraudsters exploit.
How to identify smishing:
- •Unexpected texts about accounts or deliveries you don't recognize
- •Links that use shortened URLs (bit.ly, tinyurl) or unfamiliar domains
- •Requests to call a number or visit a link to "verify" information
- •Messages from unknown numbers claiming to be from your bank
Vishing (Voice/Phone)
Vishing involves phone calls from fraudsters impersonating banks, the IRS, Social Security Administration, tech support, or utility companies. Vishing may use caller ID spoofing to display a phone number that appears to belong to the institution being impersonated. Caller ID cannot be trusted as proof of identity, since it can be manipulated.
How to identify vishing:
- •Unexpected calls claiming urgent problems with your accounts or taxes
- •Callers asking you to verify personal information before they'll help you
- •Pressure to act immediately or face consequences
- •Unexpected requests for payment via gift cards, wire transfers, or cryptocurrency, especially when combined with urgency, threats, or pressure
The Golden Rules
- 1Never give personal or financial information to someone who contacted you — If someone calls, texts, or emails you claiming to be your bank, hang up and call the number on the back of your card or on the official website.
- 2Be suspicious of unexpected calls claiming to be from a government agency — Be suspicious of unexpected calls claiming to be from a government agency and demanding immediate payment or threatening arrest or other urgent consequences. The IRS generally makes initial contact through an official letter or notice. In some circumstances, IRS personnel or authorized collection agencies may later contact taxpayers by phone, typically after written notice. Not every phone call claiming to be from the IRS is automatically fraudulent, but unexpected calls demanding immediate payment or threatening arrest are a major scam warning sign. The IRS does not demand immediate tax payment using gift cards or similar methods.
- 3Treat gift-card payment demands as a major scam warning sign — Treat any unexpected demand to buy gift cards and provide the card number or PIN as a major scam warning sign. Government agencies such as the IRS do not accept gift cards as payment for tax bills.
- 4Urgency is a manipulation tool — Pressure to act immediately can be a scam warning sign. Pause and independently verify the request using contact information you trust.
- 5Don't click links in unexpected emails or texts — Access the organization through a trusted website, official app, or known phone number instead. Hovering over a link can show the destination, but it is not proof that a link is safe.
What to Do If You Responded to a Scam
If you provided financial account information to a suspected scammer, contact your bank or card issuer promptly.
If you provided your Social Security number or other sensitive identity information, review identity-theft recovery steps and consider placing a fraud alert or credit freeze when appropriate.
If you sent money or provided gift card information to a scammer, contact the bank, payment provider, wire-transfer company, or gift-card issuer immediately and ask whether the transaction can be stopped or recovered. Acting quickly may improve the available options, but recovery is not guaranteed.
Consumers can report fraud and scams to the FTC at ReportFraud.ftc.gov. For internet-enabled crime or cybercrime, a report may also be submitted to the FBI's Internet Crime Complaint Center at IC3.gov, when appropriate. Filing a report helps authorities track fraud, but it does not guarantee recovery of lost money.