How to Avoid Phishing Scams

What Is Phishing?

Phishing is a cyberattack where scammers attempt to trick you into giving up your sensitive information, like your usernames, passwords, Social Security number, bank account information and more. They may also attempt to get you to transfer money to them via a phishing method. Phishing and spoofing are the most reported cybercrime in the United States, with 191,561 complaints last year, according to the FBI's 2025 Internet Crime Report. Victims are commonly exploited by email, though scammers may also use text messages and phone calls.

Some phishing scams use social engineering techniques to psychologically manipulate their victims. For example, a scammer may create a clone version of the website, domain name and email address of a company you do business with to build your trust. Or they may create a sense of urgency or try to scare you into sharing personal information.

Other phishing attacks use malicious software to steal information directly from your computer or device. These attacks may use tools that capture your account login information or redirect you to a fake website. According to the Anti-Phishing Working Group (APWG), 3.8 million phishing websites were detected in 2025.

Note: Chances are good that at least once a day, a phishing email lands in your work or personal inbox. A Huntress 2025 Cybercrime Report found that 44% of over 500 IT professionals polled said their organization had experienced a phishing or spear-phishing attack in the previous 12 months.

How to Spot a Phishing Scam

Whether they're aimed at business executives or consumers, phishing emails, texts and phone calls have some common characteristics. Look out for these signs that a message may be a scam.

• Urgently requires you to take action: A message that appears to come from your credit card company, for example, may warn that your account will be frozen unless you click a link and fill out a form. The goal is to get you to act quickly, fearing the consequences without thinking about the actual risks of doing so.
• Contains implied or explicit threats: For example, "Confirm your user credentials immediately or your account will be permanently frozen."
• Doesn't address you by name: Be suspicious of any email from a business you use or a well-known company that begins with "Dear account holder" instead of addressing you by name, especially if it asks for personal information.
• Requests or demands information they should already have: For example, the IRS already knows your Social Security number, so it shouldn't need you to verify it. Remember, the IRS will first mail you a letter or notice before calling or emailing, so be wary of any email from the IRS demanding money.
• Requires payment by gift card, wire transfer or cryptocurrency: Consider requests or demands to pay using these or other non-standard payment methods a red flag of a scam.
• Includes poor grammar or spelling errors: Multiple typos or spelling errors could be a sign the email does not come from a legitimate source.
• Comes from a suspicious sender email address: While many scammers can make an email address look legitimate, phishing messages often come from addresses that don't make sense. For example, an email claiming to be from your bank may come from someone's personal email account.
• Has a wrong or bogus recipient address: Scammers may know one of your email addresses, but not the one you gave to the company they're posing as. For example, you receive an email from your credit card company on your business account, even though you provided your personal email address as contact information.
• Uses an email or web address that looks slightly off: Scammers may change a letter or word in an email address or URL so it looks nearly identical to the real one.
• Includes links that don't go where they say they'll go: Scammers often embed a link in an email that directs you to a fake website equipped to steal your information or install malware on your computer. Be suspicious of links in emails, and hover your mouse over a link to see the actual URL to make sure it matches the website you expect before clicking. Better yet, don't click on any email link, and verify the message at the company's official app or web address on your own.
• Includes attachments: Be wary of an email attachment you aren't expecting, even if the message appears to come from a company you know or do business with. Phishing attachments can install malware or take you to a fake login page.
• Uses QR codes: Some phishing emails now include QR codes that, when scanned using your mobile phone, direct you to phishing websites or attempt to lead you to download malware. Be aware that traditional email filtering may fail to catch these QR codes because the link is hidden inside the code.
• Uses AI voices or videos of people you know: Scammers now use AI to clone a loved one's voice or create a fake video of them to make an urgent request seem real.

Learn more: The Latest Scams You Need to Be Aware Of

How to Protect Yourself From Phishing Scams

In addition to spotting phishing emails and text messages before they do any damage, follow these steps to protect yourself:

• Set up multifactor authentication on your online accounts. This requires anyone trying to access your account to enter a secondary form of verification sent to your phone number, email address or an authentication app. This extra step could use a code, fingerprint, facial scan, security key or approval notification to verify your identity.
• Use a secure password manager to help you create and keep track of unique passwords for each of your online accounts. These tools can generate and securely store long, random passwords that are hard to guess.
• Watch what you post on social media. Scammers look for details like your pet's name, school, birthday, hometown or street you grew up on to help them figure out a password or get past a security question.
• Avoid clicking on unknown links. On a computer, hover your mouse over the link without clicking on it to preview the URL. You can do the same thing on your phone by pressing and holding a link. Don't click or tap on the link; visit the company's site or call them directly at their official number to verify the request.
• Install security software on your computer and keep it up to date at all times.
• Back up all of your data on your electronic devices.
• Set your mobile devices to install updates automatically so older operating systems don't leave you open to known security risks.

Learn more: How to Protect Yourself From Identity Theft

What to Do if You Fall Victim to a Phishing Scam

Even if you're vigilant, you may still mistake a fraudulent message for one that looks legitimate. If you suspect you've been the victim of a phishing scam, the following steps may help you prevent or limit any damage.

1. Secure Your Devices and Accounts

If you clicked a suspicious link or opened an attachment that may have downloaded malware, disconnect your device from the internet right away. On your phone, turn off your Wi-Fi or switch to airplane mode. On a computer, unplug the ethernet cable. You want to stop any communication between your device and a scammer's server.

Once you're sure your device is completely offline, perform a full virus scan using reputable security software like Microsoft Defender or Malwarebytes. If you entered login information on a suspicious site, update the password immediately from another secure device, as some malware can record what you type. Then update any other accounts where you use the same password and enable multifactor authentication to add another level of protection against scammers.

2. Protect Your Money and Identity

As soon as you discover you've fallen victim to a scam, make the necessary moves to protect your finances and your identity. Contact your bank or financial institution immediately to report a fraudulent transfer. Ask your bank if they can recall the funds. You may be required to submit indemnification documents.

Even if you haven't lost money, contact the company or bank where the account was compromised through its official phone number or website to explain the details. You'll need to notify any banks, credit card issuers or companies that need to be on the lookout for withdrawals or charges.

Tip: It's also a good idea to check your credit report regularly to keep an eye out for any new accounts or inquiries. You have the right to place a fraud alert or a credit freeze on your credit file to help protect your credit from fraud. Consider an Experian premium membership to receive alerts, credit monitoring and fraud resolution support.

3. Report the Scam

The Federal Trade Commission (FTC) recommends forwarding emails you suspect of phishing to the Anti-Phishing Working Group at reportphishing@apwg.org. The organization analyzes reports to help track phishing campaigns and aims to protect consumers from fraud. Forward phishing texts to 7726 (SPAM), which serves as a report to your wireless carrier. Finally, file a report with the FTC at ReportFraud.ftc.gov to help investigators track down scammers.

If you suspect a scammer has your sensitive information, visit IdentityTheft.gov to find out what specific steps you should take based on the kind of information you think they have.

If you lose money due to a phishing scam, file a report with the FBI's Internet Crime Complaint Center right away to have a better chance they can freeze funds and limit damages. The FBI's Recovery Asset Team froze $679 million in 2025, with a 58% success rate.

Check if Your Information Is Exposed

Following the best practices above can help you spot and avoid phishing scams. As part of your self defense, you may want to verify if your information has been stolen so you can proactively take steps to protect yourself.

Check out Experian's free dark web scan of over 600,000 pages to find out if your information has been exposed in a phishing attack, data breach, compromised documents or malware infection. Find out whether your personal data appears on the dark web so you can take steps to protect yourself.