It starts with a message that looks almost right. A delivery notice for a package you did not order. A warning that your bank account will be closed. A message from a coworker asking you to buy gift cards. A notice that you have won a prize, or that a streaming subscription failed. In the United States, these messages arrive every day, by email, text, and social media, and they are designed to do one thing: get you to act quickly, before you have time to think. They are called phishing, and they are the most common way criminals steal passwords, money, and personal information.
Phishing works because it copies the look and language of organizations you trust. The good news is that once you know what to look for, most phishing messages are easy to spot. This guide explains how phishing works, the warning signs to watch for, the most common scams targeting Americans, and exactly what to do when a suspicious message arrives. You do not need to be a security expert to protect yourself. You need a short checklist and the habit of pausing before you click.
How Phishing Works
A phishing message pretends to be from a trusted source, such as a bank, a delivery company, a government agency, or a well-known online store. It usually contains a link to a fake login page that looks like the real one, or an attachment that installs harmful software when opened. Sometimes it asks you to reply with personal information, or to call a number where a scammer will pretend to be a support agent.
The message almost always creates urgency. Your account will be locked in twenty-four hours. A payment failed. A package cannot be delivered. A refund is waiting. Urgency is the key trick, because it pushes you to click before you check the details. Real companies rarely demand immediate action by email or text, and they do not threaten to close your account if you do not click a link right now.
Phishing has also spread beyond email. Smishing is phishing by text message, and vishing is phishing by voice call. Social media messages, fake customer support accounts, and malicious ads all use the same playbook. The channel changes, but the signs are the same: an unexpected message, a request for sensitive information, and pressure to act now.
Warning Signs to Check Before You Click
Before you click any link in an unexpected message, take a few seconds to check five things. First, look at the sender’s address, not just the display name. A message that claims to be from a bank but comes from a free email address or a misspelled domain is a red flag. Second, hover over the link without clicking, and look at where it actually goes. If the address does not match the real organization’s website, do not click it.
Third, read the message carefully for poor grammar, strange phrasing, or a generic greeting such as “Dear customer.” Large companies usually address you by name, and their messages are professionally written. Fourth, ask yourself whether you were expecting this message. Did you order a package? Did you request a password reset? If not, be suspicious. Fifth, notice the request itself. A message asking for your password, a full card number, a security code, or a payment in gift cards is almost certainly a scam, because legitimate organizations do not ask for those things by email or text.
Fake Login Pages and Lookalike Addresses
Criminals register web addresses that look like real ones, swapping a letter, adding a word, or using a different ending. A link may look right at a glance but lead to a completely different site. The fake login page will often look identical to the real one, and anything you type into it goes straight to the criminal. The safest habit is to never log in through a link in a message. Open your browser, type the organization’s address yourself, or use an app you already have installed, and log in there.
Attachments and QR Codes
Be careful with unexpected attachments, especially files that ask you to enable macros or open a document to see an invoice. Those files can install harmful software. The same caution applies to QR codes in unexpected emails or letters. A QR code can hide a link to a fake site, and you cannot see where it goes before you scan it. Only scan a code from a source you trust, and check the address it opens before you enter any information.
Common Scams Targeting Americans
Delivery scams are among the most common. You get a text saying a package could not be delivered and asking you to click a link to reschedule or pay a small fee. Delivery companies do not ask for payment or personal information by text to release a package, and they do not send tracking links for orders you never placed. If you are expecting a delivery, check its status in the carrier’s own app or website.
Bank and payment scams claim that your account has been locked, that a large charge is pending, or that you need to verify your identity. They ask you to click a link or call a number. Your bank will never ask for your full password or security code by email or text. If you are worried, call the number on the back of your card, not the number in the message.
Government impersonation scams are also widespread. Messages claim to be from a tax agency, a law enforcement agency, or a benefits program, and they threaten fines, arrest, or loss of benefits unless you pay immediately. Government agencies in the United States do not demand payment by gift card, wire transfer, or cryptocurrency, and they do not threaten arrest by email or text. Hang up, delete the message, and contact the agency through its official website if you are unsure.
Job, Prize, and Romance Scams
Other common scams promise a job, a prize, or a new relationship, and then ask for money or personal information to move forward. A real employer will not ask you to pay for training or equipment before you start, and a real prize does not require a fee to claim. Romance scams build trust over weeks or months, then ask for help with an emergency. If someone you met online asks for money, gift cards, or account access, stop and talk to a trusted friend or family member before sending anything.
What to Do When You Get a Suspicious Message
Do not click the link, do not open the attachment, and do not reply. Replying tells the sender that your address is active, which can lead to more messages. Instead, report the message. Most email services have a report phishing button. On your phone, you can report a spam text to your carrier. Reporting helps protect other people, and it takes only a moment.
If you are unsure whether a message is real, contact the organization directly using a number or address you find on its official website or on the back of your card. Do not use the contact details in the suspicious message. If the message claims a problem with an account, log in through the organization’s own app or website and check for yourself. You will usually find that there is no problem at all.
If You Already Clicked or Entered Information
If you clicked a link or entered information on a suspicious page, act quickly. Change the password for that account right away, and change it anywhere else you used the same password. Turn on two-factor authentication if it was not already on. Check your account for unfamiliar activity, and contact your bank if you entered payment information. If you downloaded an attachment, run a security scan on your device and update your software. Acting within the first hour can limit the damage, so do not wait to see what happens.
Building a Habit That Protects You
The best defense against phishing is a simple habit: pause before you click. Ask yourself who sent this, whether you expected it, and whether it is asking for something sensitive. Make it a rule to go to websites directly instead of following links in messages, and to verify urgent requests through a separate, trusted channel. Teach the same habit to your family, especially children and older relatives, who are often targeted because criminals assume they will be less suspicious.
You can also reduce your exposure by keeping your software updated, using a password manager so that it will not fill in a password on a fake site, and turning on two-factor authentication on your important accounts. No single step makes you immune, but together they make phishing far less likely to succeed. The criminals behind these messages are counting on speed and surprise. A few seconds of checking takes both away, and that is often all it takes to stay safe.