The email looks exactly like it came from your bank: right logo, right color scheme, even the right tone of voice. It says there’s been “suspicious activity” on your account and asks you to confirm your login details right away. There’s just one problem — your bank never sent it. That’s a phishing scam, and it’s still the single most common way people lose money, passwords, and personal data online, precisely because it’s built to look like something you’d trust.
Phishing hasn’t gone away as security has improved; it’s adapted. The tactics are more polished, the fake pages are harder to tell apart from the real thing, and the messages increasingly arrive by text and social media, not just email. Here’s what to actually watch for, straight from the agencies and companies that track this stuff for a living.
What Phishing Actually Is
Google defines phishing plainly, as “an attempt to steal personal information or break in to online accounts using deceptive emails, messages, ads, or sites,” according to Google’s own guidance on spotting and reporting phishing. The goal is almost always the same: get you to hand over something valuable, a password, a card number, a one-time verification code, by making the request look routine or urgent enough that you don’t stop to question it.
The Warning Signs the FTC Flags Most Often
The Federal Trade Commission’s official guide to recognizing phishing scams lists several tactics that show up over and over:
A fake problem that needs “immediate” action. Messages claiming suspicious log-in attempts, a payment failure, or a locked account, when nothing is actually wrong, are designed to make you react before you think.
Unnecessary requests to “confirm” information. Legitimate companies generally don’t need you to re-send your full account number, password, or Social Security number by email or text.
Fake invoices or charges you don’t recognize. These are built to make you click a “dispute this charge” link, which leads straight to a credential-harvesting page instead.
Generic greetings and copied branding. A message that says “Dear Customer” instead of your name, paired with a real company’s logo, is a common combination, since scammers can copy a logo far more easily than they can access a company’s actual customer list.
What Google Tells Its Own Users to Watch For
Google’s guidance points to a similar but slightly broader set of signals, including messages that impersonate a trusted organization or even someone you personally know, and messages that look nearly identical to a real communication you’d normally trust. That last point is worth sitting with: a well-made phishing email is not supposed to look suspicious. It’s supposed to look exactly like the real thing, right down to the footer text and unsubscribe link.
How to Actually Verify a Suspicious Message
Both the FTC and Google converge on the same core habit: never use the contact information or links inside the suspicious message itself to verify it. If an email claims to be from your bank, don’t click its “verify now” button or call the number listed in the email. Instead, open your bank’s app directly or type the bank’s known web address into your browser yourself, or call the number printed on the back of your card.
On a computer, hovering over a link (without clicking) will usually show you the actual destination URL at the bottom of the browser window, which often reveals a mismatched or unfamiliar domain even when the link text looks legitimate. On a phone, a long-press on a link typically shows a preview of where it actually leads.
If You Already Clicked Something
Acting fast limits the damage. If you entered a password on a suspicious page, change that password immediately, on the real site, and change it anywhere else you reused it. If you entered financial information, contact your bank or card issuer directly. The FTC directs anyone who suspects they’ve been phished to IdentityTheft.gov for personalized recovery steps, and both agencies recommend reporting the message; in Gmail specifically, Google’s own instructions are to open the message, click “More” next to Reply, and select “Report phishing,” which helps improve spam filtering for everyone.
Building Habits That Make Phishing Less Effective
A few standing habits do more than any single moment of vigilance. Enabling multi-factor authentication means a stolen password alone usually isn’t enough to get into an account, and switching to passkeys where they’re available removes the password from the equation almost entirely, since there’s nothing to type into a fake login form in the first place. Keeping devices and browsers updated closes known security gaps scammers rely on, and running reputable antivirus software adds a layer that can catch malicious links or attachments even if a message slips past your own judgment.
None of this requires being a security expert. It just requires treating urgency as a reason to slow down rather than speed up, which happens to be the exact opposite of what a phishing message is designed to make you do.
FAQs
How can I tell a phishing email from a real one at a glance?
Look for a generic greeting instead of your actual name, urgent language about a problem you weren’t already aware of, and requests to confirm sensitive information. When in doubt, don’t click anything in the message; go directly to the company’s official site or app instead.
Is phishing only a risk over email?
No. The same tactics show up in text messages, social media DMs, and phone calls. The delivery method varies, but the underlying goal, getting you to hand over credentials or click a malicious link, stays the same.
What should I do if I think I clicked a phishing link?
Change any password you entered right away on the legitimate site, watch your accounts for unusual activity, and report the message through your email provider. If financial information was involved, contact your bank or card issuer directly.
Can antivirus software stop phishing on its own?
It helps, especially at catching malicious attachments or known bad links, but it isn’t a complete solution by itself. Recognizing the warning signs and verifying requests independently remains the most reliable defense.
Do passkeys actually prevent phishing?
They make a large category of phishing far less effective, since a passkey is tied to the real website and can’t be typed into a fake one the way a password can. They don’t eliminate every scam tactic, but they remove the most common one.
Discussion about this post