Phishing texts and emails, explained
Phishing texts and emails are fake messages designed to steal your personal information. Here's how to spot them and protect yourself.
Key takeaways
- Urgency and fear in a message are classic scammer tactics
- Never click links in surprise texts or emails — type the address yourself
- Real companies won't ask for your SSN or password by text or email
- If you shared info, change passwords fast and alert your bank
You get a text. It says your bank account is locked. There's a link to click right now or you'll lose access. Your heart speeds up. That feeling is exactly what scammers want.
This is called phishing. It's when someone sends a fake message pretending to be a real company — like your bank, the IRS, or a delivery service. Their goal is to trick you into clicking a link or giving up personal information like your Social Security number, bank account details, or passwords.
Phishing can come by text (sometimes called "smishing"), email, or even a phone call. It happens to millions of people every year. It doesn't mean you're careless. These scams are designed by professionals who study how to fool people.
Here are some warning signs to watch for:
Urgency and fear. Messages like "Act now or your account will be closed" are meant to make you panic and skip thinking. Real companies rarely demand instant action like that.
Strange sender addresses or numbers. A real email from your bank will come from an official company domain. If the address looks random or misspelled, that's a red flag.
Links that look almost right. Scammers use web addresses like "paypa1.com" instead of "paypal.com." Look closely before you tap or click anything.
Requests for sensitive information. Legitimate companies will almost never ask for your full Social Security number, password, or PIN through a text or email.
Generic greetings. "Dear Customer" instead of your name can signal a mass phishing attempt.
So what should you do if you get a suspicious message?
Don't click the link. Even if the message looks real, go to the company's official website by typing the address yourself. Or call the company using a number from their official site — not the one in the message.
Don't reply with personal information. Ever.
Report it. You can forward suspicious texts to 7726 (SPAM). You can report phishing emails to the FTC at reportfraud.ftc.gov.
Delete the message. Once you've reported it, get rid of it.
If you did click a link or share information, don't panic. Change your passwords right away. Contact your bank if financial details were involved. You can also place a free fraud alert on your credit reports by contacting one of the three major credit bureaus.
You deserve to feel safe with your money and information. Knowing how these scams work is one of the best ways to stay protected.
Related FAQs
Common questions about this topic, answered simply.
What is the difference between phishing and smishing?
Phishing usually refers to fake emails meant to steal your information. Smishing is the same kind of scam, but it comes through text messages instead. Both are dangerous and work the same way — by creating urgency and tricking you into clicking a link or sharing personal details.
What should I do if I already clicked a suspicious link?
Try not to panic. Change your passwords immediately, especially for your bank and email accounts. If you entered any financial information, contact your bank right away. You can also place a free fraud alert on your credit reports by reaching out to Equifax, Experian, or TransUnion.
How can I tell if a message is really from my bank?
Your bank will not ask for your password, PIN, or full Social Security number over text or email. If you're unsure, don't click anything in the message. Instead, call your bank using the number on the back of your card or visit their official website directly.
Can phishing texts or emails put a virus on my phone or computer?
Sometimes clicking a phishing link can install harmful software on your device, even without you realizing it. It's safest to never tap unfamiliar links. If you think your device may be affected, consider running a trusted security scan or contacting your device's support team.
Where do I report a phishing scam?
You can report phishing emails to the Federal Trade Commission at reportfraud.ftc.gov. For suspicious texts, forward the message to 7726, which spells SPAM on most phone keyboards. Reporting helps authorities track and shut down scammers.
Are some people more likely to be targeted by phishing scams?
Scammers send out millions of messages at once, so anyone can be targeted. However, people who recently applied for loans, are going through financial stress, or have had data exposed in a breach may see more attempts. Staying aware of the warning signs is your best defense, no matter your situation.
Keep reading
What to do if you've been scammed
If you've been scammed, acting fast can help limit the damage. Here are the most important steps to take right away.
Read Scams and fraud protectionRomance and online scams, explained
Romance and online scams trick people into sending money to someone who is not who they claim to be. Learning how these scams work can help you spot them early and protect yourself.
Read Scams and fraud protectionRobocall and phone scam basics
Suspicious phone calls are common and can be hard to spot. Here is what to look for and how to protect yourself.
Read Scams and fraud protectionHow to freeze your credit
A credit freeze is a free tool that blocks lenders from opening new accounts in your name. It's one of the best ways to protect yourself from identity theft.
ReadTest what you learned & earn points
Take a quick 3-question quiz on this article to earn MoneyFAQ points, build your streak, and unlock badges. Free account required.
Want answers personalized to your situation?
Tell us your #1 money goal and we'll tailor MoneyFAQ to you — free, takes 10 seconds.
When you're ready, here are some options
These are ads from partners — always optional. Looking is free and never affects your credit score. Reading the guide above is completely free either way.