Phishing emails

Phishing emails pretend to come from a company or person you trust, like your bank, email provider, or an online store. They try to get you to click a link and enter your password, card number, or other personal details on a fake website. Some include attachments that can put harmful software on your device.

How this scam works

The email copies the logos, colors and wording of a real company. It gives you a reason to act fast: a locked account, a payment problem, a suspicious sign-in, an unpaid invoice, or a prize. The sender's name looks right, but the actual email address or link often doesn't match the real company.

When you click, you land on a page that looks like the real login screen. Whatever you type there goes straight to the scammer. They then use your password to get into that account and any others where you used the same password. They may also ask for a code sent to your phone so they can get past extra security.

What it can look like

EXAMPLE · NOT A REAL MESSAGESubject: Action required: your account will be suspended We noticed unusual sign-in activity. To keep your account active, verify your information within 24 hours: [link]. Failure to verify will result in permanent suspension.

Warning signs

A threat that your account will be locked or closed soon
A sender address that doesn't match the company's real website
Links that show a different address when you hover over them
Generic greetings like "Dear customer" instead of your name
Unexpected attachments, invoices or shipping notices
Requests to confirm your password, card number or one-time code

How to protect yourself

Go to accounts through a saved bookmark or official app, not email links.
Turn on two-factor authentication for email, banking and shopping accounts.
Use a different password for each important account; a password manager can help.
Don't open attachments you weren't expecting, even from people you know.
Forward phishing emails to reportphishing@apwg.org and report them to the FTC.

If you already responded

Change the password for that account right away from a trusted device, plus any account that used the same password.
Turn on two-factor authentication and check for changed email forwarding or recovery settings.
If you entered card or bank details, call the number on your card or statement and report it.
If you opened an attachment, run a full scan with trusted security software.
If you shared personal information, use IdentityTheft.gov to make a recovery plan.

Get step-by-step recovery help →

Where to report it

Common questions

How can I tell if an email is a phishing scam?

Check the actual sender address, not just the name shown. Look for urgent threats, generic greetings, and links that point somewhere unexpected when you hover over them. When in doubt, don't click. Open the company's app or type its website yourself and check your account there.

What happens if I just open a phishing email?

Simply opening an email is usually low risk. The danger comes from clicking links, opening attachments, or typing information into a page the email sends you to. Don't reply, don't click, and delete it after reporting it to your email provider or the FTC.

Where do I report a phishing email?

Use your email program's report phishing or junk button. The FTC also suggests forwarding phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and reporting them at ReportFraud.ftc.gov. If the email pretends to be a specific company, you can also tell that company through its official website.

Important: Scammers change tactics. No single warning sign proves fraud, and the absence of warning signs does not mean something is safe. This guide is general education, not legal or financial advice.