A phishing scam is a type of cyberattack where criminals impersonate a trusted entity—like a bank, government agency, or a colleague—to trick you into sharing sensitive information. The name is a play on "fishing," as scammers use "lures" to catch unsuspecting victims.
How Phishing Scams Work
Scammers typically use social engineering—psychological manipulation designed to make you act without thinking.
- The Lure: You receive an unsolicited email, text, or call that looks legitimate, often using official logos and branding.
- The Hook: The message creates a sense of urgency or fear (e.g., "Your account will be suspended") or promises a reward (e.g., "You won a gift card").
- The Action: You are prompted to click a link to a fake website that looks identical to a real one or to open an attachment that contains malware.
- The Catch: Once you enter your credentials (passwords, PINs, or credit card numbers), the scammer steals them to commit identity theft or drain your accounts.
Types of Phishing Scam
| Type | Platform | Description |
|---|
| Email Phishing | Email | The most common form, sent in bulk to thousands of people. |
| Smishing | Text Message | Phishing via SMS, often pretending to be delivery services like FedEx or Amazon. |
| Vishing | Phone Call | Voice phishing where scammers use robocalls or live agents to extract data. |
| Spear Phishing | Targeted | A personalized attack aimed at a specific person or organization. |
| Quishing | QR Codes | Malicious QR codes that lead to fake websites when scanned. |
How to Spot a Scam
- Urgent or Threatening Language: Demands for immediate action to avoid negative consequences.
- Generic Greetings: Using "Dear Customer" or "Valued Member" instead of your actual name.
- Mismatched URLs: Hovering over a link reveals a web address that doesn't match the official company site.
- Poor Grammar/Spelling: Unusual phrasing or typos, though AI is making these harder to spot.
- Suspicious Sender Address: The "From" field uses a slight misspelling (e.g.,
support@micr0soft.com instead of microsoft.com).
Received Suspicious Message
- Don’t Click or Download: Avoid interacting with any links or attachments.
- Verify Directly: Contact the organization using a phone number or website you find independently—never use the contact info in the message.
- Report It: Forward phishing emails to the Anti-Phishing Working Group or use your email provider's "Report Phishing" tool.