How to Spot Phishing Emails, Scam Texts and Fake Tech Support
Most cyberattacks don't start by breaking into your computer. They start by tricking you. Phishing emails, scam texts and fake tech-support calls are designed to get you to hand over passwords, money or access. And with AI-written messages, they're more polished than ever.
Common types of scams
• Phishing emails: messages pretending to be your bank, a delivery company, Microsoft, Apple, PayPal or your employer.
• Smishing (SMS phishing): texts about missed deliveries, unpaid tolls or suspicious bank activity.
• Tech-support scams: pop-ups or calls claiming your computer is infected, with a phone number to call.
• Fake login pages: websites that look identical to the real thing and capture your password.
• Impersonation scams: messages from a "boss" or family member urgently asking for money or gift cards.
• Smishing (SMS phishing): texts about missed deliveries, unpaid tolls or suspicious bank activity.
• Tech-support scams: pop-ups or calls claiming your computer is infected, with a phone number to call.
• Fake login pages: websites that look identical to the real thing and capture your password.
• Impersonation scams: messages from a "boss" or family member urgently asking for money or gift cards.
Red flags to watch for
• Urgency or threats: "Your account will be closed in 24 hours."
• Requests for sensitive info: passwords, verification codes or card numbers.
• Mismatched links: hover over a link (don't click) to see where it really goes.
• Odd sender addresses: a real-looking name with an unusual address or misspelled domain.
• Unusual payment methods: gift cards, crypto or wire transfers.
• Unexpected attachments: especially "invoices" you weren't expecting.
• Too good to be true: prizes, refunds or tax rebates you didn't ask for.
• Requests for sensitive info: passwords, verification codes or card numbers.
• Mismatched links: hover over a link (don't click) to see where it really goes.
• Odd sender addresses: a real-looking name with an unusual address or misspelled domain.
• Unusual payment methods: gift cards, crypto or wire transfers.
• Unexpected attachments: especially "invoices" you weren't expecting.
• Too good to be true: prizes, refunds or tax rebates you didn't ask for.
Note: good spelling and grammar no longer mean a message is safe.
Golden rules
1. Never trust contact details in the message itself. If your "bank" emails you, go to their website by typing the address yourself, or call the number on your card.
2. Never share one-time verification codes. A legitimate company will never ask you to read one back to them.
3. Real tech companies don't call you out of the blue or show pop-ups with phone numbers.
4. Pause before acting on urgency. Scammers rely on panic.
2. Never share one-time verification codes. A legitimate company will never ask you to read one back to them.
3. Real tech companies don't call you out of the blue or show pop-ups with phone numbers.
4. Pause before acting on urgency. Scammers rely on panic.
Tech-support scam pop-ups
If a browser page suddenly goes full-screen with alarms and warnings telling you to call a number, don't call. Close the browser. If it won't close, use Task Manager (Ctrl + Shift + Esc) on Windows or Force Quit (Cmd + Option + Esc) on a Mac. Your computer isn't actually infected; it's just a web page.
What to do if you've already clicked
• Entered a password? Change it immediately on the real website, and anywhere else you've used it. Turn on two-factor authentication.
• Gave card or bank details? Call your bank using the number on your card and ask them to block the card.
• Let someone remote into your computer? Disconnect from the internet, uninstall any remote-access software they installed, run a malware scan, and change your passwords from another device.
• Sent money? Contact your bank or payment provider immediately. Speed matters.
• Gave card or bank details? Call your bank using the number on your card and ask them to block the card.
• Let someone remote into your computer? Disconnect from the internet, uninstall any remote-access software they installed, run a malware scan, and change your passwords from another device.
• Sent money? Contact your bank or payment provider immediately. Speed matters.
Where to report it
• Forward phishing emails to your email provider using its "Report phishing" button.
• US: reportfraud.ftc.gov. UK: forward emails to report@phishing.gov.uk and texts to 7726.
• Report fake messages to the company being impersonated.
• US: reportfraud.ftc.gov. UK: forward emails to report@phishing.gov.uk and texts to 7726.
• Report fake messages to the company being impersonated.
The bottom line
Scammers exploit trust and urgency. Slow down, verify through official channels, and never share codes or passwords. That one pause can save you a lot of trouble.
