Is this text, email or link a scam? How to spot phishing

A text, email or message says there's a problem with your account, a package, a payment or a prize, and asks you to tap a link, open an attachment or reply. Some of these are real, but many are phishing: fake messages built to steal your passwords, card numbers or money. Here's how to check before you click.

Warning signs

These come from the FTC, Microsoft and Apple. One sign alone doesn't prove it's fake, but if you see any of them, slow down.

• It says there's suspicious activity, a problem with your account or payment, or that your account is on hold.
• It asks you to confirm personal or financial information, or to update your payment details through a link. The FTC says real companies won't email or text you a link to update your payment information.
• An invoice or charge you don't recognize, often with a phone number to call to “cancel” it.
• A package delivery problem you weren't expecting.
• A prize, gift card, coupon or government refund you didn't ask for.
• A generic greeting (“Dear customer”) instead of your name.
• The sender's address or number doesn't match the company it claims to be, or has extra letters or numbers.
• The link's real address doesn't match the company's website (see below).
• Urgency or threats: “within 24 hours,” “your account will be closed.”
• An unexpected attachment, or a request to enable macros or install something.

Step by step: check a message safely

1. Look at who really sent it

   In email, tap or click the sender's name to see the full address. In texts, look at the number. Does it match the company? A bank won't text from a random personal number or email from a free webmail address.

2. See where a link really goes, without opening it

   • Computer: rest your mouse pointer on the link (don't click). The real address shows at the bottom of the window. In Safari on a Mac, if you don't see it, choose View → Show Status Bar.
   • iPhone or iPad: touch and hold the link to preview the address. Don't tap the preview.

   Find the site's real name: look at the end of the address, just before the first single slash (/). In paypal.com.evil.net/login, the real site is evil.net, not paypal.com. Another made-up example: yourbank.com.account-check.example is not yourbank.com. If in doubt, don't open it.

3. Check with the company yourself

   Open the company's own app, or type its web address into your browser, and sign in there. If there's really a problem, you'll see it. Or call the number on the back of your card or on a statement.

4. Report it, then delete it

   • Text message: copy the message and forward it to 7726 (spells SPAM). This helps your carrier block similar texts. You can also report it in the app: on iPhone, tap Report Junk under the message; on Android in Google Messages, touch and hold the conversation → Block → Report spam → OK.
   • Email: use your email's Report phishing or Junk option (in Outlook, select the message, choose Report (or Report Junk), then Phishing). You can also forward it to the Anti-Phishing Working Group at [email protected].
   • Pretends to be Apple? Forward the email (or a screenshot of the text) to [email protected].
   • Everyone: report it to the FTC at ReportFraud.ftc.gov.

Protect yourself for next time

• Keep your phone and computer updated, and keep security software on automatic updates.
• Turn on two-step verification (also called multi-factor authentication) for your email and bank. It makes it harder for scammers to get in even if they get your password.
• Never share a verification code someone texts or emails you, with anyone who contacts you.
• Filter unknown senders. On iPhone, you can block a sender by tapping their name at the top of the conversation, then Block Caller.

If you already clicked, replied or typed in a password

1. Change that password now

   Go to the real site yourself (not the link) and change it. If you use the same password anywhere else, change it there too. Start with your email account.

2. Gave a card or bank number?

   Call your bank or card company using the number on the back of your card, and tell them.

3. Gave your Social Security number?

   Go to IdentityTheft.gov for a step-by-step plan.

4. Opened an attachment or downloaded something?

   Update your security software and run a scan. On Windows: Windows Security → Virus & threat protection → Quick scan.

5. An Apple Account password?

   Change your Apple Account password right away and make sure two-factor authentication is on.

Message told you to call a number and someone took over your computer? See what to do if you let someone in.

Related scam guides: Scary pop-up says your computer is infected? · Someone called saying they’re from Microsoft or Apple · Is this text, email or link a scam? · Is this phone number a scam?

Sources

• FTC: How to recognize and avoid phishing scams
• FTC: How to recognize and report spam text messages
• Apple: Recognize and avoid social engineering schemes, including phishing messages
• Apple: Block phone numbers, contacts, and emails on your iPhone or iPad
• Microsoft: Protect yourself from online scams and attacks (phishing section)
• Microsoft: How do I report phishing or junk email? (Outlook)
• Google: Report spam in Google Messages