What is phishing? How to spot a phishing email or text

What is phishing? It's a scam in which criminals pose as a company or person you trust, usually by email or text, to trick you into giving up passwords, card numbers or other personal details, or into opening a harmful link or attachment. Don't act on the message itself. The FTC says to contact the company through a website or phone number you know is real.

Last updated October 31, 2026

Dark title card reading "What is phishing? How to spot it and what to do" under the label Security Guide

The short version

Phishing messages imitate banks, delivery companies, payment apps and tech companies to get your login details, financial information or money.
Phishing arrives by email, text (smishing), phone call (vishing) and social media. Spear phishing targets a specific person or company.
Warning signs include urgency, requests for personal information, mismatched sender addresses and links that don't go where they say.
CISA warns that poor grammar is no longer a reliable sign, because AI lets scammers write polished messages.
If you clicked or replied, change the affected passwords, call your bank if you shared financial details and run a security scan.

What is phishing?

The National Institute of Standards and Technology (NIST) describes phishing as "tricking individuals into disclosing sensitive personal information through deceptive computer-based means." The Federal Trade Commission (FTC) puts it in everyday terms: scammers use email or text messages to get your passwords, account numbers or Social Security number. With that information they can get into your email, bank or other accounts, or sell it to other scammers.

Not every phishing message asks for information directly. The Cybersecurity and Infrastructure Security Agency (CISA) says criminals also try to get you to open harmful links, emails or attachments that could ask for personal information or infect your device.

Phishing is a form of social engineering. Rather than breaking into a system, the attacker persuades a person to open the door. Microsoft says the messages "try to look like official communication from legitimate companies or individuals."

Types of phishing

The name changes with the channel and the target, but the trick is the same.

Type	How it reaches you	What the sources say
Email phishing	Email that links to a fake website or carries an attachment	The FTC says scammers may pose as a bank, a utility or a payment app.
Smishing	Text message	CISA defines smishing as social engineering that exploits SMS messages. The FTC lists fake package delivery notices and prize offers as common lures.
Vishing	Phone call or voicemail	CISA describes vishing as social engineering that uses voice communication.
Spear phishing	Usually email, aimed at a specific person or company	The UK's National Cyber Security Centre (NCSC) says the attacker uses information about your employees or company to make the messages more persuasive and realistic.
Whaling	Usually email, aimed at senior staff	The NCSC calls whaling a type of spear phishing that targets a "big phish," such as a board member with access to valuable assets.

Spear phishing often draws on what people post publicly. The NCSC says criminals use information from social media to make messages more convincing, so it suggests reviewing what you share and your privacy settings.

How to spot a phishing email

No single sign proves a message is a scam, but these are the signs the FTC, CISA, Microsoft, Apple and Google point to.

It's unexpected. Microsoft says to treat a sudden message from a company or person you rarely deal with as suspect. Apple adds that an unsolicited message with an attachment is a warning sign.
It creates urgency or fear. CISA flags urgent or emotionally charged language, especially threats of serious consequences if you don't act right away. Google also warns about offers that seem too good to be true.
It asks for personal or financial information. Microsoft says official communications generally won't request personal information by email. Google says Gmail won't ask for your password over email.
The sender doesn't add up. Look for addresses with added numbers or changed letters that imitate a real company, or a sender address that doesn't match the signature.
The link goes somewhere else. On a computer, hover over a link to see the real address before you click. Google says that if the URL doesn't match the link's description, it may lead to a fake site. CISA also warns about untrusted shortened links.
It looks off. Apple says to be wary of a message that looks significantly different from others you've had from the same company. Microsoft flags greetings that don't address you personally or pull your name from your email address.
It asks you to change settings. Microsoft says ordinary emails won't ask you to enable macros, adjust security settings or install apps.

Don't rely on typos: Spelling and grammar mistakes used to be the classic giveaway. CISA now says AI lets scammers write polished messages, so check for the other signs too.

The FTC's own example is a fake email that uses a real company's logo, a generic greeting and a link to update payment details.

How to spot a phishing text

Scam texts use the same tricks in fewer words. The FTC says they often claim suspicious activity on your account, a payment problem, an invoice for something you didn't buy or a package delivery issue, and then try to get you to click a link. The FTC says: "Legitimate companies won't ask for information about your account by text."

Phishing vs spam: what's the difference?

The FTC says that at best spam is annoying, while at worst it pushes scams or tries to install malware. Phishing is a specific kind of scam: the FTC describes it as scammers using email or texts to trick you into giving them personal and financial information. Gmail and Outlook both have a separate option to report a message as phishing, as the reporting section below explains.

What to do with a suspicious message

Don't click links or open attachments. CISA says that includes "unsubscribe" links.
Don't reply. Never send passwords, account numbers or PINs by email, text or phone.
Check with the company directly. If you have an account with the company, the FTC says to contact it using a phone number or website you know is real, not the details in the message.
Report it, then delete it. The next section explains how.

How to report phishing

Reporting helps email providers and authorities block the same scam for other people. The NCSC says it can investigate and take down scam email addresses and websites.

In your email app

Gmail on a computer: open the message, click More next to the Reply button, then click Report phishing.
Outlook.com: select the message, then select Report above the reading pane and choose Report phishing. Microsoft notes that reporting doesn't block the sender.

Texts

In the US, the FTC says to forward scam texts to 7726 (SPAM) so your wireless provider can block similar messages.
On an iPhone, Apple says you can tap Report Junk under a suspicious message in Messages.

To authorities and companies

US: forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and report the attempt to the FTC at ReportFraud.ftc.gov.
UK: forward scam emails to the NCSC at report@phishing.gov.uk. You don't need to forward messages that are already in your spam or junk folder.
Apple: forward suspicious emails that claim to be from Apple to reportphishing@apple.com. For a text, Apple says to send a screenshot to the same address.

What to do if you clicked a phishing link

Act quickly, and work through whichever of these applies.

You entered a password: change it right away, plus the password on any other account that uses the same one. The NCSC suggests using a passkey instead where it's available.
You shared bank or card details: contact your bank and card company. CISA says to watch for unexplained charges and close affected accounts if needed.
You shared your Social Security number or other identity details (US): the FTC says to go to IdentityTheft.gov for steps based on what was taken.
You opened an attachment or installed something: update your security software, run a full scan and remove anything it flags.
It happened on a work device: tell your IT department right away.
You lost money in the UK: the NCSC says to tell your bank and report it to Report Fraud (England, Wales and Northern Ireland) or Police Scotland.

If the scam targeted your Apple Account, Apple says to change the password immediately and make sure two-factor authentication is on.

How to protect yourself from phishing

The FTC recommends 4 habits:

Use security software and set it to update automatically
Set your phone's software to update automatically
Turn on multi-factor authentication
Back up your computer and phone

The FTC says multi-factor authentication makes it harder for scammers to get into your accounts. Our guide to two-factor authentication shows how to turn it on for Google, Apple and Microsoft accounts. For the strongest protection, CISA says the only widely available phishing-resistant authentication is FIDO/WebAuthn. The FIDO Alliance says passkeys are built on its standards. Our explainer on what a passkey is covers how to set one up.

If you use an older Windows PC, our guide to lightweight antivirus for old PCs explains whether Microsoft Defender is enough.

Frequently asked questions

Is phishing a form of social engineering?

Yes. CISA describes phishing as a form of social engineering that uses email or malicious websites to ask for personal information while posing as a trustworthy organization. Smishing and vishing are the text and voice versions.

Is phishing a type of malware?

No, but it can be used to deliver malware. The FTC says scammers sometimes send phishing emails with links or attachments that install harmful malware when opened or clicked. Others lead to a fake website that asks for your details. NIST's definitions describe both email and fake-website versions.

What is phishing-resistant MFA?

It's sign-in protection designed to resist fake websites. CISA says that if you're fooled into entering your details on a fake site, the FIDO protocol blocks the attempt, and it calls FIDO/WebAuthn the only widely available phishing-resistant option. The FIDO Alliance says passkeys are built on FIDO standards. CISA also says "any MFA is better than no MFA."

What is the best way to spot a phishing email?

Treat any unexpected message that asks you to act quickly, sign in or share information as suspect, then verify it on your own. Go to the company's website or app directly, or call a number you already know, instead of using anything in the message.