How to Recognize Phishing Emails and Texts, and What to Do If You Clicked
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A plain-English summary of the Federal Trade Commission's consumer guide to recognizing and avoiding phishing scams and its guide to identity theft (linked below), checked October 29, 2026. For phishing aimed at a business, such as fake invoices and payment-change requests, see our guide to business email compromise and phishing.
Phishing is the everyday version of a scam: an email or text that looks like it's from a company you trust and tries to get you to click, log in or pay. The FTC says scammers launch thousands of these attacks every day, and they often work. Here is how to spot them and what to do next.
What phishing is after
According to the FTC, scammers use email or text messages to try to steal your passwords, account numbers or Social Security number. With those, they can get into your email, bank or other accounts, or sell your information to other scammers.
The stories phishing messages tell
Phishing messages usually tell a story so you'll click a link or open an attachment. The message may look like it's from your bank, credit card company, utility or a payment app. The FTC's list of common claims, with the truth:
| The message says... | The reality |
|---|---|
| There's been suspicious activity or log-in attempts | There hasn't |
| There's a problem with your account or payment information | There isn't |
| You need to confirm personal or financial information | You don't |
| Here's an invoice (one you don't recognize) | It's fake |
| Click this link to make a payment | The link has malware |
| You're eligible to register for a government refund | It's a scam |
| Here's a coupon for free stuff | It's not real |
Scammers also update their stories to match the latest news and trends, so the details change; the pattern doesn't.
Signs in a fake "billing problem" email
The FTC walks through a real-world phishing email that copied a streaming company's logo. The giveaways:
- A generic greeting instead of your name.
- A claim that your account is on hold because of a billing problem.
- A link to update your payment details.
The FTC's key point: real companies may email you, but legitimate companies won't email or text you a link to update your payment information.
Four ways to protect yourself
Spam filters catch many phishing emails, but not all. The FTC recommends four layers:
- Use security software on your computer and set it to update automatically. (On Windows, see our guide to the Windows Security app.)
- Set your phone's software to update automatically.
- Turn on multi-factor authentication, so a stolen password isn't enough. Passkeys go further; see our passkeys guide.
- Back up your data to an external drive or the cloud. See our 3-2-1 backup guide.
The question to ask before you click
When an email or text asks you to click a link or open an attachment, the FTC suggests asking: Do I have an account with this company, or do I know the person who contacted me?
- No: it could be phishing. Look for the signs above. If you see them, report the message and delete it.
- Yes: contact the company using a phone number or website you know is real, not the information in the message. Links and attachments can install malware.
If you responded or clicked
The FTC gives two paths:
- You gave out information such as your Social Security, credit card or bank account number: go to IdentityTheft.gov's page for lost or stolen information, which lists specific steps based on what you lost.
- You clicked a link or opened an attachment that may have downloaded harmful software: update your security software, run a scan and remove anything it flags.
If you typed a password into a fake page, change it on the real site right away, and anywhere else you reused it. Our guide to account recovery setup helps if you get locked out.
Where to report phishing
The FTC says to:
- Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.
- Forward phishing texts to SPAM (7726).
- Report the attempt to the FTC at ReportFraud.ftc.gov.
For text-message versions, see our guides to package delivery text scams and QR code scams.