Phishing: What It Looks Like & How to Stop It

Phishing is a cyberattack where criminals impersonate a trusted person or organization to trick you into revealing passwords, credit card numbers, or other sensitive data. This article explains the common forms phishing takes, how to recognize the warning signs, and the exact steps to take if you suspect you are a target.

What Phishing Looks Like

Phishing messages can arrive by email, text message, social media direct message, or even a phone call. The most common form is a fraudulent email that appears to come from a legitimate company like a bank, an online retailer, or a government agency. The message usually creates a sense of urgency—claiming your account will be locked, a payment failed, or a package is undeliverable—and includes a link or attachment that leads to a fake login page or downloads malware.

For example, you might receive an email that looks like it is from your bank, with the correct logo and a similar sender address, saying “Your account has been suspended due to suspicious activity. Click here to verify your identity.” The link goes to a look-alike website that asks for your username, password, and possibly your social security number. Once you enter that information, the attackers capture it and use it to access your real accounts.

How Phishing Works

Phishing relies on social engineering—manipulating human psychology—rather than hacking technical vulnerabilities. The attacker’s goal is to get you to act without thinking. They often use:

• Urgency or fear: “Your account will be closed within 24 hours.”
• Curiosity: “You’ve received a voicemail” or “Someone mentioned you in a post.”
• Greed: “You’ve won a prize” or “You’re entitled to a tax refund.”
• Authority: Impersonating a CEO, government official, or tech support.

Once you click the link, you may be taken to a fake login page that looks nearly identical to the real one. The URL might differ by one letter (e.g., paypa1.com instead of paypal.com). If you enter your credentials, the attacker captures them. Some phishing emails also contain attachments that, when opened, install keyloggers or ransomware.

How to Spot a Phishing Email

While some phishing attempts are crude and full of typos, many are highly sophisticated. Look for these red flags:

• Sender address: Check the full email address, not just the display name. A message from “PayPal” might actually come from paypal-support@gmail.com.
• Generic greeting: Legitimate companies usually address you by name. “Dear Customer” or “Dear User” is a warning sign.
• Spelling and grammar: Awkward phrasing, missing words, or unusual punctuation.
• Unsolicited attachments: Any unexpected file, especially .zip, .doc, or .exe, could contain malware.
• Mismatched URLs: Hover over any link (without clicking) to see the actual destination. If the visible text says “Click here” but the link goes to an IP address or a misspelled domain, it’s fake.
• Requests for personal information: Legitimate organizations never ask for your password, PIN, or full credit card number via email or text.

What to Do If You Receive a Phishing Message

If you suspect an email or text is phishing, do not click any links, download attachments, or reply. Instead:

1. Do not engage. Do not click “unsubscribe” either—that just confirms your address is active.
2. Report it. Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org. If the message impersonates a specific company, forward it to that company’s abuse or security team. For text messages, forward to 7726 (SPAM) on most carriers.
3. Delete the message. Once reported, delete it from your inbox and trash.
4. If you clicked a link or entered information: Immediately change the password for that account and any other accounts using the same password. Contact your bank or credit card company if you entered financial details. Run a full antivirus scan on your device.
5. Enable two-factor authentication (2FA) on all important accounts to add an extra layer of protection even if your password is stolen.

Common Phishing Variations

Phishing has evolved into several specialized forms:

• Spear phishing: Targeted attacks against a specific person or company, using personal details (like your job title or recent purchases) to make the message more believable.
• Whaling: Spear phishing aimed at senior executives or high-value targets. The email might appear to come from a board member or legal counsel.
• Smishing and vishing: Phishing via SMS text messages (smishing) or voice calls (vishing). A vishing call might say your computer has a virus and ask you to install remote-access software.
• Clone phishing: Attackers copy a legitimate email you’ve received and replace the link or attachment with a malicious one, claiming the original was updated.
• Pharming: Redirecting you to a fake website without your knowledge, often by compromising a DNS server or installing malware on your device.

How to Protect Yourself

Prevention is the best defense. Adopt these habits:

• Think before you click. If an email seems unexpected or too good to be true, go directly to the company’s website by typing the URL yourself, not by clicking the link.
• Use a password manager. It will auto-fill credentials only on the correct, legitimate domain, so you won’t be tricked into typing your password on a fake site.
• Keep software updated. Updates patch security vulnerabilities that phishers can exploit.
• Use email filters. Most providers have spam filters that catch many phishing attempts. Mark suspicious messages as spam.
• Be skeptical of unsolicited calls. If someone calls claiming to be from tech support, hang up and call the official number.

What to Do If You’ve Been a Victim

If you believe you’ve already fallen for a phishing attack, act quickly:

1. Change passwords for the affected account and any other account that uses the same password. Do this from a different, known-secure device.
2. Contact the real company (bank, email provider, etc.) using the official customer service number or website.
3. Check for unauthorized transactions on your bank and credit card statements. Report any suspicious activity.
4. Run a security scan on your computer or phone to check for malware.
5. Consider placing a fraud alert with the major credit bureaus if you entered sensitive data like your Social Security number.
6. Report the incident to the Federal Trade Commission at ftc.gov/complaint if you’re in the US, or your local cybercrime authority.

Frequently Asked Questions

How can I tell if an email is phishing if it looks legit?

Check the sender’s full email address, hover over links to see the real URL, and look for generic greetings or urgent language. When in doubt, contact the company directly using a phone number or website you know is legitimate, not the one in the email.

What should I do if I clicked a phishing link but didn’t enter any information?

If you didn’t enter credentials or download anything, the risk is low. Still, run an antivirus scan and monitor your accounts for unusual activity. If you did enter information, change passwords immediately and contact the relevant institutions.

Can phishing happen on my phone?

Yes. Smishing (SMS phishing) is common. Text messages may contain links to fake websites or prompt you to call a fraudulent number. Treat unsolicited texts with the same caution as emails, and never tap links in messages from unknown numbers.

Is it safe to click “unsubscribe” in a phishing email?

No. Clicking “unsubscribe” often just confirms your email address is active and monitored, which can lead to more phishing attempts. Instead, mark the message as spam and delete it.

Does two-factor authentication protect me from phishing?

It adds a strong layer of protection. Even if a phisher gets your password, they still need the second factor (like a code from your phone) to access your account. However, some sophisticated attacks can intercept those codes, so always be cautious about where you enter your credentials.

Related

• Valve Index Setup: SteamVR From Scratch
• Most Secure Email Services: Top Picks Compared
• Claude Code 42 Token Savings: What It Really Shows