Phishing Scams: Recognize and Report Suspicious Messages

A message says your delivery has failed, your bank account is locked or your boss needs a gift card urgently. It may look ordinary, but its purpose can be to make you click a harmful link, open a dangerous attachment or hand over information. This is phishing: a social engineering attempt that uses a convincing story to make someone act against their own interests.

Phishing is not limited to email. It can arrive by text, phone call, social media message or a shared document notification. Learning to slow down and verify a request is more useful than memorizing one particular scam, because the stories and designs keep changing.

What is phishing?

Phishing occurs when an attacker impersonates a trusted person or organization to persuade you to take an action that benefits them. The message may lead to a fake sign-in page, ask for a payment, request a verification code or deliver a malicious file. CISA describes phishing as a common tactic across email, text, social platforms and phone calls. See CISA’s guide to recognizing and reporting phishing.

The attacker does not always need sophisticated technology. A message that creates fear or excitement can be effective if the recipient acts before checking. A fake page may copy an organization’s colors and logo, and a message can appear to come from a familiar name.

Some attacks are targeted at a particular person or organization and use details gathered from public sources. A message that mentions your real name, employer or a recent purchase is therefore not automatically genuine. Equally, a message containing a spelling mistake is not always malicious; context and independent verification matter more than one clue.

The common pattern: a story, pressure and an action

Many phishing attempts have three parts. First comes a believable story: a failed payment, a security alert, an invoice or a package. Second comes pressure: “act now,” “your account will be closed” or “do not tell anyone.” Third comes the requested action: sign in through a link, open an attachment, pay a fee or share a code.

Imagine receiving a text saying a parcel cannot be delivered until you pay a small address-correction fee. You may be expecting a parcel, which makes the story plausible. Instead of opening the text’s link, use the retailer’s or delivery company’s app or a known website to check the order. If there is a genuine problem, you should be able to investigate through that independent route.

Urgency by itself does not prove fraud, and genuine organizations sometimes send important alerts. The safe response is to verify the claim without using the contact details supplied in the suspicious message.

Warning signs worth noticing

• Unexpected pressure: The message demands immediate action and discourages you from checking.
• Requests for secrets: Someone asks for your password, recovery code, one-time code or approval of a sign-in you did not initiate.
• Unusual payment instructions: A contact suddenly asks for gift cards, cryptocurrency or a change to bank details.
• Surprising links or files: A message asks you to open an attachment or install software without a clear reason.
• Address inconsistencies: The sender’s address or link domain does not match the organization it claims to represent.
• A request outside normal procedure: A colleague asks you to bypass a usual approval or contact them only through a new number.

These signs are prompts to investigate, not a perfect checklist. Scammers can write polished messages without spelling errors, and a compromised real account can send messages from a familiar address. A legitimate-looking sender name alone is not proof of identity.

Inspect the address, but do not rely on appearance alone

A display name can say “Customer Support” while the underlying address belongs to someone else. On many email apps you can expand the sender details to inspect the address. That can reveal obvious mismatches, but the address is only one clue: messages can be spoofed in some circumstances, and genuine accounts can be taken over.

For a link, pay attention to the actual domain rather than the logo on the page. A name appearing somewhere in a long address does not establish ownership. For example, in example.com.attacker.test, the relevant ending is not example.com. Link previews can help, but short links and complicated addresses can be difficult to judge.

The safest route for an important account is usually to open the organization’s official app or type a known address yourself. If the request claims to be from a colleague, contact them using a number or channel you already trust, not one included in the message.

HTTPS is not a trust certificate for the business

HTTPS protects a connection in transit and helps your browser verify the certificate for the requested domain. It does not prove that the person operating the website is honest. A fraudulent site can have a valid certificate and an HTTPS address.

A browser warning about an invalid certificate is a reason not to enter sensitive information. But the absence of a warning does not make every site safe. Verify the domain and the reason you are there, especially if the page asks for payment details or a one-time code after an unexpected message.

Similarly, a polished design, familiar logo or “secure” badge can be copied. Treat them as visual elements rather than evidence that a service is legitimate.

Scams in email, texts and calls

Email: A fake invoice may ask you to open a file or change payment details. Verify through the supplier’s established contact information. For workplace invoices, follow the organization’s approval process and confirm changes to bank details using a known telephone number.

Text messages: A delivery or account alert may contain a short link. Open the relevant official app or visit a known address to check. Do not reply merely to ask whether the text is real; that can confirm your number is active.

Phone calls: A caller may claim to be your bank, technical support or a government agency. Caller ID can be misleading. Hang up and call back using the number on your card, a statement or the official website. Never provide a one-time code or approve a sign-in you did not start.

Social messages: A friend’s account can be compromised. An unusual request for money, a code or a quick click deserves confirmation through another established channel. Be particularly cautious if the message says the person cannot speak on the phone or insists on secrecy.

A safe response checklist

1. Pause. Do not click, download, reply, pay or approve a sign-in while you are uncertain.
2. Identify the claimed organization or person. Ask what the message wants you to do and why.
3. Use an independent route. Open a known app, type a trusted address or call a number you already have.
4. Check the underlying issue. Review the account, order or invoice directly rather than relying on the message’s link.
5. Report where appropriate. Use your email provider’s phishing-reporting control or your organization’s security process. In the United States, the FTC accepts reports through its official fraud reporting site.
6. Delete or quarantine the message. Follow workplace procedures first if the message arrived on a managed account.

Reporting options differ by country and provider. Do not forward suspicious attachments to friends for advice. If you need help, describe the request or use the organization’s designated reporting channel.

What if you clicked a link?

Clicking is not the same as giving away a password, but the right response depends on what happened next. Close the page. If you did not enter information or download anything, check for browser warnings and follow your organization’s guidance if the device is managed. Keep the device and browser updated.

If you downloaded a file, do not open it. Follow your security software’s guidance and seek trusted technical help if you ran it or are unsure. Disconnecting a potentially compromised work device and contacting the IT team may be appropriate under the organization’s incident procedure; do not improvise changes that interfere with an investigation.

If you entered a password, use a trusted device to change it through the real service. Change it anywhere else it was reused, starting with the most important accounts. Review active sessions, recovery details and multi-factor authentication settings. A password manager can help you create a unique replacement.

What if you shared a code or payment information?

If you shared a one-time code or approved an unexpected sign-in, treat the account as potentially compromised. From a trusted device, use the provider’s official account-recovery guidance, change the password, review sessions and remove unfamiliar authentication methods where possible. Contact the provider if you cannot regain control.

If you gave payment-card or banking details, contact your bank or card issuer immediately using a trusted number and explain what happened. They can advise on monitoring, blocking or replacing the relevant instrument. If you sent a payment, ask promptly about recovery options; outcomes vary and may be limited.

Keep a record of what happened, including the time and the information you shared, but do not continue interacting with the suspected scammer. Report the incident through the appropriate provider, employer or local authority. Avoid anyone who promises to recover the loss for an upfront fee; that can be another scam.

Build habits that reduce the risk

Use unique passwords, enable multi-factor authentication and keep your devices updated. Where available and practical, phishing-resistant authentication such as a supported security key or passkey offers stronger protection against certain fake-site attacks than a manually entered code. These tools help, but they do not replace careful verification.

For important services, create bookmarks after independently confirming the address. Agree on a callback procedure for payment changes at work or in a family business. Keep account recovery options up to date, and use backups so a malicious file is less likely to destroy your only copy of important data.

It is also worth creating a culture where people can admit a mistake quickly. Shame and delay help attackers. If a family member or colleague clicks something suspicious, focus on securing the account and getting assistance rather than blaming them.

Frequently asked questions

Can a real company send a genuine security alert?

Yes. Treat the alert as a reason to check the account, but use the official app or a known address instead of the message’s link. This lets you respond to a real problem without trusting an unverified message.

Does a message from a friend’s account prove it is safe?

No. The account may have been compromised, or the display name may be imitated. Verify unusual requests through another established channel, especially when money or codes are involved.

Should I reply to tell a scammer to stop?

Usually the safer choice is not to engage. Use the provider’s reporting and blocking controls, and follow workplace procedures where relevant. Replying can confirm that someone is reading the account.

Can a QR code be used for phishing?

Yes. A QR code can direct your device to a website, including a fraudulent one. Preview the destination when your device allows it, and use a known website or app for sensitive actions rather than scanning an unexpected code.

The habit to remember

When a message asks for a secret, payment or urgent sign-in, separate the claim from the evidence. Pause, open a trusted channel yourself and verify the underlying issue. That small delay can prevent a hurried mistake while still allowing you to respond to a genuine problem.

Further reading: CISA: Recognize and report phishing; FTC: Protect your personal information. Reporting procedures and available protections vary by country and service.