Every day, criminals send thousands of deceptive messages by email and text to steal passwords, account numbers, and Social Security numbers. These attacks can give someone access to your email, bank, or cloud accounts, or let them sell your information to others.
Learn simple signs that a message is dangerous: urgent requests, fake invoices, offers of refunds or coupons, or links that push malware. Scammers often claim billing problems or suspicious activity to make you act fast.
This guide shows practical steps to protect your accounts, like keeping software updated, using multi-factor authentication, and verifying contacts via official websites or phone numbers you find yourself. If you shared personal data, IdentityTheft.gov can walk you through recovery. To help others, report phishing emails to reportphishing@apwg.org, forward scam texts to 7726, or file a report at ReportFraud.ftc.gov.
Key Takeaways
- Watch for urgent requests and unexpected attachments in email.
- Verify links and phone numbers on official websites before you act.
- Use strong passwords, MFA, and regular backups to improve security.
- Report suspicious messages: reportphishing@apwg.org, 7726, or ReportFraud.ftc.gov.
- If personal data was shared, follow steps at IdentityTheft.gov for recovery.
Spot the signs of phishing in emails, texts, and calls
Many dangerous messages look urgent and official, but small errors give them away. Learn a few clear signs that an email, text, or phone contact is not what it seems.
Urgency and threats: If a message demands immediate action to stop an account suspension or claim a reward, pause. Pressure and sudden deadlines are classic tactics to force mistakes.
Broken language and generic greetings: Watch for “Dear customer” or odd grammar. Even when a logo looks real, sloppy spelling or a wrong company name is a red flag.
Sender and domain checks: Inspect the sender address. Look‑alike domains (micros0ft.com or rnicrosoft.com) and unverified sender banners are strong warning signs.
Links and attachments: Hover or long‑press to preview a link before clicking. Unexpected attachments or pages that mimic a login form often aim to capture passwords or account numbers.
Texts and calls: Fraudsters may impersonate support teams and pressure you for a PIN or one‑time code. If anything feels odd, contact the company using a number or site you find yourself.
Practical steps to avoid phishing scams every day
A few routine steps can cut your risk of online attacks on both computer and phone. Start with automatic updates so operating systems and security software install fixes without you having to remember.
Keep security software and mobile OS up to date
Set updates to install automatically. This closes known holes that attackers use to reach your accounts and information.
Turn on multi‑factor authentication
Use something you know (a passcode), something you have (authenticator app, text code, or security key), or something you are (biometrics). MFA stops many attacks even if a password is stolen.
Back up data and verify requests
Store important files on a trusted cloud service or an external drive so a bad link or malware can’t hold them hostage.
When a message asks for action, open a new browser tab and type the company website yourself. Or call a number you find independently instead of using contact details in a message.
Preview links and watch your inbox
On desktop, hover to see the real destination. On mobile, long‑press a link to reveal the URL. Be extra cautious with first‑time senders flagged by your inbox and limit what personal information you share online.
If you suspect a phishing attempt, take these actions
If a message makes you uneasy, treat it as a potential threat until you can confirm otherwise. Do not click links or open attachments. Simple hesitation can stop an attack from spreading.
Don’t click links or open attachments; delete or report the message
Stop and isolate the threat: Do not click a link, open an attachment, or reply to the sender. Mark the item unsafe and move on.
Report inside your tools: In Microsoft 365 Outlook choose Report > Report phishing to remove the item from your inbox and help filters learn. In Teams, hover the message, choose More options > More actions > Report this message and select Security risk.
Confirm directly with the company via known, official contact details
If you think the message might be real, open a new tab and type the company’s official website yourself. Or call a verified phone number from your statement or the company website.
Never use contact details from the suspicious message itself; fraudulent phone numbers and pages are often planted to make the attempt look official.
Report phishing in your tools and to authorities
If you use another mail app, attach the original message as a file and send it to phish@office365.microsoft.com so analysts can inspect headers. Forward phishing emails to reportphishing@apwg.org and report malicious texts to 7726 (SPAM).
To alert browsers, in Microsoft Edge select Settings and More (…) > Help and feedback > Report unsafe site. File a report at ReportFraud.ftc.gov to aid enforcement, then delete the message to lower the chance of accidental clicks.
Responded already? Reduce risk fast
If you already responded to a suspicious message, act quickly to limit what the attacker can take. Swift actions cut the chance of continued access and reduce harm to accounts and identity.
Change passwords on affected and reused accounts
Change passwords for any account you think might be exposed. Prioritize email, bank, cloud, and any site where you reused the same password.
Create strong, unique passwords and use a password manager to store them securely.
Enable MFA everywhere and log out of active sessions
Turn on multi‑factor authentication on all accounts that offer it. Then review active sessions and trusted devices.
Sign out unknown sessions to cut off attackers’ current access.
Update and run security scans to remove malware
Update your computer and phone security software, then run a full scan to find and remove malware from attachments or links.
Contact your bank or card issuer; monitor statements
If you shared financial details, call your bank or card company right away. Ask them to flag accounts, issue new cards, and add extra verification.
Watch statements and set alerts for unusual transactions.
Place fraud alerts and use IdentityTheft.gov
If sensitive information like account numbers or your Social Security number was exposed, place fraud alerts with the credit bureaus: Equifax (800‑525‑6285), Experian (888‑397‑3742), and TransUnion (800‑680‑7289).
Go to IdentityTheft.gov for a personalized recovery plan and call 1‑877‑IDTHEFT if you need help reporting identity theft.
Stay safer online starting now
Small daily steps make a big difference. Set devices to install updates automatically, enable multi‑factor authentication, and keep regular backups so a single suspicious email or link can’t take down an account.
Before you click a link or call a number in a message, open a fresh browser tab and go to the company’s official website or dial a phone number you look up yourself. Use link previews (hover or long‑press) and never interact with unexpected attachments.
If you see a likely phishing email, report it to reportphishing@apwg.org, forward scam texts to 7726, and file a report at ReportFraud.ftc.gov. For recovery help after shared information, visit IdentityTheft.gov and follow the steps to protect credit and accounts.
