Written by Ms. Alyssa Soto
Published on 1/13/26
Congratulations! You've won!
You might have seen texts or emails with a header like this to get you to click into them and read all about the great prize or opportunity that has just landed in your lap. The message might be offering you gift cards for stores you've shopped at before, discounted tickets to that event you wanted to go to, or a remote job offer with a generous paycheck! But wait, isn't this too good to be true?
Sadly, the answer is likely yes. With the advent of the Internet came a new type of criminal activity called cybercrime. You may be familiar with this term referring to hackers in movies or people who pirate licensed content, but those are just the tip of the iceberg. Cyber criminals are involved in anything from taking down servers and bringing entire cities to a standstill to draining the bank accounts of the unfortunate individuals who fall for their schemes. The latter is often done through a socially engineered scam known as phishing.
Phishing (yes, that is how it's spelled) is when scammers attempt to trick you into giving them sensitive information such as passwords, credit card information, or your social security number while posing as a trusted entity. They will often claim to be a customer service representative for your bank or another company you have purchased products from to gain your trust. Sometimes, they will claim to be a security officer or even a government worker to scare you into doing what they say. However they present themselves, their ultimate goal is to obtain information that will grant them access to your emails, bank accounts, or your personal technology for their financial gain.
Phishing emails are the main way that a scammer will attempt to obtain your information, but they may also attempt to contact you through phone calls or text messages. Each method of contact has its own phishing term (strange spellings included). This section will go over a few common types of phishing scams, what they might look/sound like, and how to identify them as scams.
Email phishing is when a scammer reaches out to you via email. This is the most common type of phishing scam you will encounter. The scammer will usually pose as a trusted person or company reaching to notify you of job offers, login activity warnings, overdue bills, or prizes that you've supposedly won. These emails will almost always be about something time sensitive to get you to act quickly.
Type of Contact: Email
What They Might Say:
Remote job offers with great hourly pay, sign on bonuses, and/or company-provided funds to build a home office
Suspicious login activity detected on an account you own
Overdue bills or declined payment notices
Prizes or sweepstakes winnings
Red Flags:
Will not call you by name, may address you as "customer" or as your email's username
to recap, your email's username is the section before the @ symbol on your email address
Generic signatures or formatting without a company logo
Blurry images (logos, buttons, etc.)
Poor grammar, misspelled words, or images of text instead of typed, highlightable text
Excessive emoji use in the subject line or body of the email
Names of people, positions, or companies are typed in ALL CAPS
What To Do:
Report the email as spam, junk, or phishing (different email providers may have different options)
Delete the email without responding to it
Voice phishing or "vishing" is when a scammer contacts you over the phone or by leaving voice mails insisting that you call them back. They will often fail to identify themselves or what company they are calling on behalf of, or they may claim to be part of a government program or department. Their calls and voice mails usually boil down to "there is an emergency and you need to act now."
Type of Contact: Phone call or voice message
What They Might Say:
Claims to have more information on a deal or other request you made with them
Suspicious financial activity detected on your bank account
Overdue bills or declined payment notices
There is an emergency and you need to contact them back or give them information
Red Flags:
They do not identify who they are or where they are calling from
Example: they may say they are from "the dealership" instead of naming the exact dealership they are from
Person on the other side of the phone or voicemail is a recording or an AI-generated voice
Will ask you to call them back at a number that is not the same as the one they called from
May ask you to confirm bank transactions, passwords, login codes, or other confirmation information
You hear a "boop" noise before hearing someone say "hello"
They ask you to download or run lines of code on your phone or computer
What To Do:
Hang up as soon as you realize it is a scam
Avoid saying "yes" or "no" answers
Example: if they ask "can you hear me?" respond by saying "I can hear you" instead of saying yes
Delete suspicious voicemails without responding or calling back
SMS phishing or "smishing" is when a scammer contacts you via text message. The messengers may claim to be job recruiters who saw your contact information on a job board such as Indeed, or they may act as an automated message from a mail delivery service like USPS or from a state's parking/fast lane billing messaging service. These messages will also try to incite a sense of urgency to get you to act without stopping to think.
Type of Contact: SMS or text message
What They Might Say:
Remote job offers with great hourly pay, sign on bonuses, and/or company-provided funds to build a home office
Suspicious login activity detected on an account you own
Overdue bills or declined payment notices for a medical, phone, car, or parking bill
Red Flags:
Message may be accompanied by blurry image of a company logo
Message may be from an email instead of a phone number
You are added to a group text with people you don't know
Asks you to reply with a certain keyword to indicate interest
Asks you to click on a link or copy and paste it into your browser
Asks you to call a phone number provided in the text instead of the number they messaged you from
What To Do:
Don't respond to the text, not even to be funny
Don't click on any links they give you
Report the text as spam (if your phone has that feature) and block the number or email that messaged you
Delete the text(s)
Pharming is when a scammer directs you to a spoofed website to steal login credentials or other sensitive data. It usually occurs alongside one of the aforementioned types of phishing. If a smishing text or phishing email included a link for you to click, chances are that it took you to a spoofed website for data pharming.
Type of Contact: QR code or URL/link
What They Might Say:
Claim to be a login page to access your account/order information
Claim to be a password reset page
Ask you to fill out a form to confirm interest in a job/product/service/event
Red Flags:
URL has "sites.google" instead of just the company's domain
URL does not have the company's domain name in it or is misspelled
The webpage's format is different from what the site usually looks like
Login windows don't detach from the browser or move off the webpage
What To Do:
Don't enter any information, not even false information
Don't click on anything on the webpage, especially any "submit" or "confirm" buttons
Close out the page, ignoring or closing any messages that pop up on the page
Make sure that popups and automatic downloads are disabled on your computer/browser
As the saying goes, knowing is half the battle. Being aware of the type of scams that exist and what they might look or sound like is one of the best ways to learn how to identify scams. However, it can be difficult to memorize every type of phishing scheme -- especially when new techniques are being developed every day by attackers. Instead, you can learn how to root out legitimate communications from scams.
When you next receive an email, text, or voicemail claiming there is an emergency situation that you must act on immediately, make sure you do the following things first:
Check the Sender
Text messages should be from phone numbers, not from emails with gibberish for a username
Emails from corporate entities should have their company name as the domain, not google.com, hotmail.com, or some other mainstream mailing provider
To recap, the domain is everything after the @ symbol in the email address
You can also reverse-search the email to see if it appears in job boards or online company rosters
If the caller's location is from a place you don't recognize, don't answer it
Ask Questions
If in a call, demand the person identify themself and where they are calling from
If they refuse to give their name or company's name and instead try to steer you back to the "emergency," hang up
Ask them where they got your information from
If they say they got your number from a database, hang up. It's a cold-caller trying to sell you something
Contact the Source
If you suspect the initial call, email, or text is a scam but want to confirm there is no issue, you can contact the place where the supposed "emergency" originated from
If the person claimed there was fraudulent activity on your credit card, call your bank directly to confirm
If they claimed there was an issue with your account's password, log in to your account that they claim was locked or flagged, and change your password for that account for good measure
If a text tells you to click their link to pay an overdue bill or confirm information, go directly to the website they claim to be contacting you from instead of clicking the link
Example: If the text says they are from the Department of Transportation and want you to click a link to pay for or dispute a ticket, go directly to azdot.gov instead of clicking on the link
Do Some Research
Look up the names of companies or the people who are contacting you if they gave you a name
Most companies will have a publicly available employee roster
See if other people have reported receiving the same message(s) as you did and whether those messages were part of a scam
Spear phishing is a specific type of phishing that occurs when scammers do research on you before contacting you. They may look at your social medias or job board profiles to gather information about who you are, who your family and friends are, the places you visit, the things you buy, where you currently work or have worked, and even where you currently live and any places you used to live. This allows them to tailor a scenario that feels legitimate enough to trick you. The level of thoroughness and planning is what makes spear phishing one of the most difficult scams for victims to identify and protect themselves against.
Messages from spear phishing attackers may take the form of calls, voice mails, text messages, or emails. They can address you by name and claim that someone from your workplace asked them to reach out regarding an issue or that someone from your social circle recommended you for a service or prize game. The amount of information that an attacker has obtained allows them to respond to anything you throw at them to make them trip up and reveal themselves as a scammer, which means they are more likely to get the information they want from you.
Sounds scary, right? So what can you do to defend yourself against such a perfectly curated attack? The answer is as complicated as the problem itself.
Get into good password practices
Use complicated passwords, not leetspeak phrases or words with certain vowels replaced with symbols
Your school password is a good example of a complicated password
Never reuse passwords for multiple online accounts
If someone gets a hold of your Gmail password that you also used for your bank account, they will be able to access your bank account too. Using different passwords for every account prevents this
Take advantage of encrypted password savers instead of saving passwords on your unprotected notepad app
Keep tabs on data leak reports and change your passwords when they occur
Opt into Multi-Factor Authentication (MFA) for anything that offers it
It can be annoying, yes, but it can also be the last defense against an attacker who is trying to get into your accounts
Limit how much personal information you post online
Keep your social media profiles on Private and never post your locations, home addresses, or places of work
As far as my social media knows, I have been working at Doofenshmirtz Evil Incorporated for the past 10+ years
Have a separate email address that you use strictly for work communication and job applications, and don't use that address to make social media accounts or post it on your social media
First of all, breathe. Panicking and beating yourself up for being tricked won't help if a scammer manages to get a hold of your information. What you do next depends on the type of scam you were hit with and what information was given to the scammer. Below are some basic guidelines for what to do:
Change your password(s)
Change any and all passwords that you suspect are compromised
If you used a single password for different accounts, you should change the password for each account
Make sure to select "sign out of all devices" when you change your password
Reach out to the customer service of the company your compromised account belongs to
If you lost access to an account, you may need to contact the customer service department of the company your account belonged to
Contact your bank to let them know of the scam if your credit card information was involved
They can help you freeze your card and accounts and issue you a new card with new information
Check your accounts for any unauthorized transactions and let the bank know about them as soon as possible
Contact the Social Security Administration if your social security number was involved
You can report scams and identity theft at the Social Security Administration reporting site
Report the incident to the Federal Trade Commission
Website: ReportFraud.ftc.gov
Email: forward to reportphishing@apwg.org
SMS/Text: forward to 7726
When reaching out, make sure you have:
How and when you think phishers seized your information
Bank statements showing unauthorized transactions and/or credit reports with signs of fraud
The amount of fraudulent charges
The names, phone numbers, and/or email accounts of everyone involved in the scam
Check your accounts for unfamiliar recovery emails/phone numbers
Scammer can leave backdoors to your account to gain control over your account again
These can be checked under your account security settings
Check your accounts regularly
Keep a close eye on your email, bank, or other accounts for any funny business for the next few months at the very least