Phishing & Smishing Scams
Last updated September 18, 2026
The short answer
You got an email or text that looks like it's from a company you trust, like your bank, Amazon, Netflix, or the post office, asking you to click a link, verify your account, or confirm a payment. The message is fake. The link goes to a website designed to steal your login information or personal details.
How it works
- 1
You get a message that looks real
The email or text uses a real company's logo, colors, and language. It might say there's a problem with your account, a package delivery, or a suspicious charge.
- 2
The message creates urgency
"Your account will be locked in 24 hours." "Confirm your delivery or it will be returned." "We detected unauthorized access." They want you to act before you think.
- 3
The link goes to a fake website
It looks exactly like the real company's login page. The URL is slightly different, maybe "amaz0n-secure.test" instead of "amazon.com." But on a phone, it's hard to notice.
- 4
They capture what you type
When you enter your username and password on the fake page, the scammers now have your login. They may also ask for your credit card, Social Security number, or other personal info.
Warning signs
- The message says something is urgent and you need to act now
- It asks you to click a link to "verify" or "confirm" your account
- The sender's email address doesn't match the company it claims to be from
- The URL looks slightly off (extra characters, misspellings, different domain)
- The message has typos or awkward phrasing
- You didn't expect the message: no recent order, no account issue
- It asks for personal information that a real company would already have
What it looks like
"Your package couldn't be delivered"
You get a text that says "USPS: Your package could not be delivered. Schedule redelivery: [link]." The link goes to a fake USPS page that asks for your address and a $1.95 "redelivery fee," plus your credit card number.
"Unusual sign-in activity on your account"
An email that looks exactly like it's from Netflix says someone signed into your account from a new device. "Wasn't you? Secure your account now." The link goes to a login page that looks real but captures your credentials.
"You have a pending refund"
A text claims your bank is holding a refund for you and you need to "verify your identity" to claim it. The link leads to a fake bank login page. After you "log in," it asks for your Social Security number to "verify your identity."
What to do
- Don't click any links in the message.
- If you already clicked and entered a password, change that password immediately on the real website. Do it from a new browser tab, not from the link.
- If you use the same password anywhere else, change it there too.
- Turn on two-factor authentication (the code they text you when you log in) on your important accounts.
- Check your bank and credit card statements for charges you didn't make.
- Report phishing emails by forwarding them to reportphishing@apwg.org.
Who gets targeted
Everyone with an email address or phone number gets phishing attempts. Scammers send millions of messages at once. They don't know anything about you. They're casting a wide net.
Clicking a phishing link doesn't mean you're careless. Some of these messages are nearly identical to real ones.
By the numbers
- Phishing and spoofing was the most-reported cybercrime of 2025, with 191,561 reports
- FBI IC3, 2026
- $215.8 million in reported phishing losses in 2025
- FBI IC3, 2026
- The median time from opening a phishing email to entering credentials on a fake site is under 60 seconds
- Verizon DBIR, 2024
Frequently asked questions
What is the difference between phishing and smishing?
Phishing uses email, smishing uses text messages (SMS + phishing). Both use fake messages pretending to be from trusted companies to steal your information. The tactics are identical. Only the delivery method differs.
I clicked a phishing link but didn't enter any information. Am I safe?
Probably. Simply clicking a link is usually not enough to compromise your accounts. However, some links can install malware. Run an antivirus scan to be safe. If you entered any credentials, change those passwords immediately.
How can I tell if an email is phishing?
Check the sender's email address (not just the display name). Look for urgency ("act now"), generic greetings ("Dear Customer"), and links that don't match the company's real domain. When in doubt, go directly to the company's website instead of clicking links.
Companies used in phishing & smishing scams
These are the brands scammers hide behind in this scam. Each guide covers what that company will never ask you for, and how to report it to them directly.