How to Recognize a Phishing Message: Signs and What to Do

What phishing is

CISA says phishing is when criminals try to get you to open harmful links, emails or attachments that could request your personal information or infect your devices. Messages usually come as email, text, social media direct message or phone call, and are often designed to look like they are from a trusted person or organisation.

Signs CISA lists

• Urgent or emotionally appealing language, especially claims of dire consequences if you do not respond immediately.
• Requests to send personal and financial information.
• Untrusted shortened URLs.
• Incorrect email addresses or links, like amaz a n.com.

CISA adds that poor grammar used to be a common sign, but in the era of artificial intelligence some emails now have perfect grammar and spelling, so do not rely on it.

Stories the FTC says scammers tell

The US Federal Trade Commission says a message might claim suspicious activity or log-in attempts, a problem with your account or payment information, a need to confirm personal or financial information, an invoice you do not recognise, or a link to make a payment. It says legitimate companies will not email or text you a link to update your payment information.

What to do

1. Do not click links or attachments, and do not call a number in the message.
2. Check another way. If it might be real, contact the organisation using a website or phone number you know is real.
3. Report it, then delete it.
4. If you already clicked on a link or opened an attachment that may have downloaded harmful software, update your security software, run a scan and remove anything it flags (FTC).

The FTC's reporting channels in the source are US ones, so we do not list them.

Fact-checked on 30 October 2026 against the sources listed below. Prices and plans change, so confirm with the provider before you buy.