Phishing is one of the most common ways accounts get taken over. Scammers send messages pretending to be banks, delivery companies, employers, government agencies, tech support or even friends, aiming to trick you into revealing passwords, codes or payment details, or into installing malware. Messages can be convincing, and new tools make them more polished than ever.
This guide covers the red flags to watch for and what to do when you are unsure.
Common Phishing Channels
- Email: Fake account alerts, invoices, shipping notices
- Text messages: Package delivery problems, toll bills, bank alerts
- Phone calls: Fake bank fraud departments, tech support, government agencies
- Social media and messaging apps: Fake friends, giveaways, job offers
- QR codes: Codes on fliers, parking meters or emails leading to fake sites
Red Flags
Urgency and Fear
Messages that say your account will be closed, a payment failed, you owe a fine or you must act immediately are designed to rush you.
Unexpected Requests
Be wary of messages you did not expect, especially asking you to log in, confirm details or pay.
Requests for Codes
Never share a two-factor code with anyone who contacts you. Legitimate companies generally will not call asking for it. See two-factor authentication setup.
Unusual Payment Methods
Requests for gift cards, wire transfers, cryptocurrency or payment apps to strangers are strong scam signs.
Mismatched Senders and Links
The display name may say a well-known company while the actual address is unrelated. Links may point to lookalike domains with small misspellings or extra words. On a computer, hover over links to preview the destination.
Generic Greetings and Odd Details
Some phishing uses generic greetings, but modern scams can be personalized using data from breaches or data brokers. Personalization alone does not mean a message is legitimate. See the data broker removal guide.
Attachments
Unexpected attachments, especially those asking you to enable macros or open archive files, can carry malware.
How to Check Safely
- Do not click links or call numbers in the suspicious message
- Go to the company’s website by typing the address yourself or using your bookmark
- Call the number on the back of your card or on an official statement
- Check your account directly for any alerts
- If a friend asks for money, contact them through a different channel
Your Password Manager as a Phishing Detector
Password managers typically autofill only on the site where credentials were saved. If your manager does not offer to fill, double-check the address. See the password manager guide.
If You Clicked or Shared Information
| What happened | What to do |
|---|---|
| Entered a password | Change it immediately, and anywhere reused |
| Shared a 2FA code | Change password, review account activity, contact the company |
| Shared card details | Contact your card issuer |
| Sent money | Contact your bank or payment provider immediately |
| Downloaded a file | Run security scans and update your device |
| Shared personal data | Consider a credit freeze |
Report phishing to the impersonated company and to the FTC. Many email services have a report phishing button.
Protecting Family Members
Older relatives and teens are frequent targets. Agree on a family rule: no one pays or shares codes based on an unexpected call or message without checking with someone else first. Some families use a code word for emergencies.
Common Mistakes
- Trusting caller ID
- Clicking links in urgent messages
- Sharing codes with someone claiming to be from your bank
- Feeling too embarrassed to report
A Note on AI-Generated Scams
Scammers increasingly use tools that write fluent messages and can imitate voices. Poor grammar is no longer a reliable sign of a scam. Focus instead on the request: urgency, secrecy, payment or codes. If a call sounds like a relative in trouble, hang up and call them back on a number you know, or use a family code word.
A Note on Fake Websites and Ads
Phishing sites sometimes appear in search ads or results, especially for customer service numbers, banking logins and package tracking. Use bookmarks for important sites, check the address carefully and be cautious with phone numbers found through searches.
Questions to Ask Before Acting
- Was I expecting this message?
- Is it asking for money, codes or login details?
- Is it pressuring me to act fast or keep it secret?
- Can I verify through a channel I already trust?
Final Habit Checklist
- Bookmarks for important accounts
- Password manager autofill used
- Two-factor authentication on
- Family code word agreed
A Note on Workplace Phishing
At work, phishing often impersonates executives, vendors or IT staff, asking for urgent payments, gift cards or password resets. Follow your employer’s verification procedures, report suspicious messages to IT and never bypass payment approval steps because someone claims urgency.
Starting Small
This week, bookmark the login pages for your bank, email and main shopping accounts, and use only those bookmarks to sign in. That single habit sidesteps many phishing links.
A Note on Reporting
Reporting phishing helps email providers and companies block similar messages for others.
A Note on Delivery Texts
Fake delivery and toll texts are common. Check tracking directly on the carrier’s site.
Frequently Asked Questions
How do I know if an email is phishing?
Look for urgency, unexpected requests, mismatched senders and suspicious links, and verify directly.
Can phishing texts be dangerous if I do not click?
Generally the risk comes from clicking, replying or calling. Delete and report.
Is caller ID reliable?
No. It can be spoofed.
What if I already entered my password?
Change it right away and enable two-factor authentication.
Do passkeys help against phishing?
Yes. See passkeys explained.
The Bottom Line
Slow down, verify through official channels, never share codes and use a password manager, two-factor authentication and passkeys to make phishing much less effective.
Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.