How to Protect Yourself Against Phishing

Phishing is one of the most common ways people lose money, passwords, and personal information. Attackers impersonate trusted companies, banks, government agencies, delivery services, coworkers, or even friends to trick you into clicking a malicious link, opening an attachment, entering credentials on a fake site, or approving a login.

It arrives through email, text messages (smishing), phone calls or voicemails (vishing), social media, QR codes (quishing), and more. AI has made many messages more polished and personalized, so grammar and spelling are no longer reliable giveaways. The core defense is simple habits: pause, verify independently, and never let the message control how you respond.

Spot a Phishing Message in Seconds

Look for these common red flags:

• Unexpected urgency or threats: “Your account will be locked in 24 hours,” “Act now or face penalties,” “Suspicious activity detected,” or “Confirm immediately.”
• Requests for sensitive information: Passwords, one-time codes, Social Security numbers, bank details, or payment information. Legitimate organizations almost never ask for these via unsolicited email, text, or call.
• Generic or mismatched greetings: “Dear Customer” or “Dear User” instead of your name. Or the display name looks right but the actual sender address does not.
• Suspicious links: Hover (desktop) or long-press (mobile) to preview the destination. Look for slight misspellings, extra characters, unfamiliar domains, or shortened URLs. The displayed text may say “bank.com” while the real link goes somewhere else.
• Unexpected attachments or QR codes: Especially invoices, documents, or “scan to verify” codes you weren’t expecting.
• Pressure to bypass normal processes: “Don’t tell anyone,” “Use this specific link,” or “Call this number right away.”

If something feels off (even if the message looks professional) treat it as suspicious.

How to Handle Suspicious Messages

1. Do not click, open, reply, or download anything in the message. This includes “unsubscribe” links in suspicious emails.
2. Verify independently. Go to the official website by typing the address yourself, using a bookmark, or opening the official app. Call the organization using a phone number from their real website, a statement, or the back of your card—not any number or link in the message. Caller ID can be spoofed.
3. Report it, then delete it. Most email providers have a “Report phishing” or “Report spam” option. Forward phishing emails to the Anti-Phishing Working Group at [reportphishing@apwg.org](mailto:reportphishing@apwg.org). For texts, forward to 7726 (SPAM). You can also report to the FTC at ReportFraud.ftc.gov.
4. Trust but verify even familiar senders. A compromised friend’s or coworker’s account can send convincing messages. Confirm unusual requests (especially involving money or codes) through a different channel.

Secure Your Online Accounts

Phishing often targets credentials so attackers can take over accounts. Strong account hygiene limits the damage.

• Use unique, strong passwords (or better, passkeys where available) for every important account. A password manager generates and stores them securely so you don’t reuse passwords or rely on memory. One breach shouldn’t unlock everything else.
• Enable multi-factor authentication (MFA) on email, banking, shopping, social media, and any other sensitive accounts. Prefer authenticator apps, passkeys, or hardware security keys over SMS when possible—SMS codes can be intercepted or phished more easily. Even if a password is stolen, MFA usually stops the attacker.
• Watch for MFA fatigue or code phishing. Never share one-time codes or approve unexpected login prompts. Legitimate services will not ask you to read a code to someone over the phone.
• Review account activity and sessions periodically. Revoke old or unrecognized devices and logins.

Protect Your Devices and Browser

• Keep your operating system, browser, apps, and security software updated. Updates often patch vulnerabilities that phishing or malware can exploit.
• Use the built-in phishing and safe-browsing protections in modern browsers and email services. Enable spam filters and any available anti-phishing features.
• Be cautious with public Wi-Fi and consider a reputable VPN when using untrusted networks.
• Preview links carefully and type important site addresses manually or from bookmarks. Password managers can also help—they typically won’t autofill credentials on look-alike domains.
• For QR codes, inspect the destination if possible before proceeding, and prefer official apps or typed URLs for payments or logins.

Channel-Specific Tips

• Email: Check the full sender address, not just the display name. Be wary of unexpected password resets or invoice attachments.
• Text/SMS (smishing): Delivery notices, bank alerts, and “missed package” messages are common. Never click the link—check the official app or site yourself.
• Phone/voice (vishing): Hang up and call back on a number you look up yourself. AI voice cloning makes familiar voices less trustworthy. Never share codes or remote-access permission.
• QR codes (quishing): Treat unexpected QR codes like any other link. Prefer scanning only codes from sources you trust and control.

If You Think You’ve Been Phished

Act quickly:

1. If you entered credentials, change the password on the real site immediately (and anywhere else you reused it). Enable or strengthen MFA.
2. If you clicked a link or downloaded something, run a malware scan with updated security software and monitor accounts for unusual activity.
3. Contact your bank or credit card company right away if financial information was involved. Watch statements and consider a fraud alert or credit freeze if identity information was shared.
4. Report the incident to the FTC (ReportFraud.ftc.gov), the FBI’s IC3 (ic3.gov), and the affected organization.
5. Notify family or contacts if your accounts were compromised and used to send more phishing.

Additional Habits That Help

• Slow down. Urgency is a classic tactic—legitimate requests can usually wait a few minutes while you verify.
• Limit what you share publicly. Attackers use social media and leaked data for more convincing spear-phishing.
• Educate family members, especially those who may be less familiar with current tactics.
• Regularly review privacy settings and connected apps/accounts.

Phishing succeeds when people act before thinking. Building the habit of pausing and verifying through a channel you already trust stops the majority of attempts. Combine that with unique credentials, MFA, and basic device hygiene, and you become a much harder target.