Phishing scams: fake emails and look-alike websites

How do phishing scams work?

Phishing scams are a trick to get you to hand over information or access. A scammer pretends to be someone you trust, such as your bank, a store, a delivery company, a government agency or even a friend, and sends a message designed to make you click, log in or reply.

The FTC explains that scammers use email and text messages to steal passwords, account numbers and Social Security numbers. With them, they can get into your email, bank and other accounts, or sell your information to other criminals.

Phishing and spoofing, which covers scam emails, texts and calls, is the crime type reported most often to the FBI’s Internet Crime Complaint Center. Its 2025 annual report counted 191,561 phishing and spoofing complaints, more than any other crime type. Our plain-English guide What is phishing? covers the basics.

What do phishing emails usually ask for?

Phishing emails tell a story that ends with you clicking a link or opening an attachment. The FTC lists the stories it sees most often. A phishing message might:

• Say there has been suspicious activity or a log-in attempt on your account.
• Claim there’s a problem with your account or payment information.
• Ask you to “confirm” personal or financial information.
• Include an invoice you don’t recognize.
• Want you to click a link to make a payment.
• Say you’re eligible for a government refund.
• Offer a coupon or free gift.

The FTC’s own example shows an email with a company’s real logo, a generic greeting and a warning that the account is on hold because of a billing problem, plus a link to update payment details. Real companies won’t email or text you a link to update your payment information. See six annotated phishing email examples.

How do fake websites trick people?

The link in a phishing message usually leads to a copy of a real site: a bank log-in page, a shopping checkout or a delivery payment form. Anything you type there goes straight to the scammer.

Fake sites rely on quick glances. The address may be one letter off, use an extra word, or end in a different domain. The page may show the company’s real logo and even a padlock icon. A padlock only means the connection is encrypted. It doesn’t mean the site is honest.

The safest habit is to never sign in or pay through a link in a message. Type the address yourself or use the company’s official app. Our checklist for checking if a website is legit shows what to look for before you buy.

What should you do with a suspicious message?

The FTC suggests asking one question: Do I have an account with this company, or do I know the person who contacted me? If not, it could be phishing. Even if you do, don’t use the link. Contact the company using a phone number or website you know is real.

Then:

1. Report it. Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, and report them to the FTC at ReportFraud.ftc.gov. See how to report a phishing email.
2. Delete it.
3. Protect your accounts. The FTC recommends security software and phone updates set to install automatically, multi-factor authentication on your accounts, and regular backups.

If you already clicked or entered information, change the password for that account (and any account that uses the same one), turn on two-step verification, and contact your bank if you shared financial details. If friends are getting strange emails from your address, read is your email spoofed or hacked? Our first-hour checklist covers the rest.

More guides: Amazon impersonation scams, QR code scams, identity theft: what to do in the first 24 hours and holiday shopping scams.