How to Spot a Phishing Email or Text Message

Phishing (pronounced "fishing") is a type of scam where criminals send a fake email or text message designed to look like it comes from a company or organization you trust — your bank, Medicare, the IRS, Amazon, or UPS. The goal is always the same: to trick you into clicking a link, entering your password, or handing over personal information like your Social Security number or credit card number.

The name comes from fishing — scammers cast a wide net, sending millions of fake messages and hoping a few people will take the bait.

Phishing is the most common type of cybercrime reported to the FBI. In 2024, Americans lost more than $2.7 billion to phishing and related scams. The good news: once you know what to look for, these messages are usually not difficult to spot.

---

The 7 warning signs of a phishing message

1. Urgent or threatening language

Scammers want you to act before you think. Phishing messages often contain phrases like:

• "Your account will be suspended in 24 hours!"
• "Immediate action required — your Social Security number has been compromised."
• "You must confirm your identity today or lose access."
• "Final notice before legal action."

Legitimate companies — banks, the IRS, Medicare, Amazon — do not threaten to close your account or take legal action within hours through an email. If a message sounds alarming and demands you do something right now, pause and treat it as a red flag.

2. The link address does not match the real company

Before clicking any link in an email, look at where it actually goes. On a computer, hover your mouse over the link (do not click — just rest the mouse pointer on it) and look at the bottom of your screen. The real web address will appear there.

Scammers create websites with names that look close to the real thing: - 'amazon-helpdesk.net' instead of 'amazon.com' - 'paypa1.com' (with a number 1 instead of a letter l) instead of 'paypal.com' - 'irs-refund-claims.com' instead of 'irs.gov' - 'amaz0n-deals.ru' (ending in .ru, a Russian domain) instead of 'amazon.com'

If the address looks unusual or does not end in the company's official domain, do not click.

On a phone, press and hold the link for a moment (do not tap) — on most phones, this shows you the full web address before you open it.

3. Poor spelling and grammar

Many phishing messages contain spelling errors, awkward sentences, or phrases that do not sound natural. This is especially true for messages that appear to come from government agencies or large corporations, which have professional communications teams. A message riddled with typos is a warning sign.

4. The sender's email address looks off

Look carefully at the email address in the "From" field — not the display name, but the actual email address. Scammers often set the display name to "Medicare" or "Amazon Customer Service" but the actual sending address is a random or suspicious address:

• Display name: Amazon Customer Service
• Actual address: 'support@amazon-billing-helpdesk.com' or 'no-reply@xvb9284.net'

Amazon's real emails come from addresses ending in '@amazon.com'. Your bank's real emails come from addresses ending in the bank's official domain. When in doubt, look up the company's official email domain on their website.

5. They ask for a password, credit card number, or Social Security number

No legitimate company will ever ask for your full password, Social Security number, or credit card number in an email or text message. The IRS does not send emails asking for your Social Security number. Medicare does not text you asking for your card number. Your bank does not email you asking for your PIN.

If a message asks for any of this information, it is a scam. Period.

6. Unexpected attachments

Be cautious of any email you were not expecting that includes an attachment — especially files ending in '.zip', '.exe', '.doc', or '.pdf'. Opening a malicious attachment can install software on your computer that records your keystrokes or locks your files.

If you were not expecting a document, do not open the attachment. If you think it might be real, contact the sender by phone using a number you look up yourself — not a number provided in the email.

7. "You've won a prize!" messages

If you receive a message saying you have won a lottery, a gift card, a free vacation, or a cash prize — and you did not enter any contest — it is a scam. These messages ask you to click a link or call a number to "claim your prize," which leads to requests for your personal information or a small "processing fee."

---

Common phishing scenarios targeting seniors

• **Fake Medicare messages:** A text or email says your Medicare card is expiring or your benefits are being updated. They ask you to confirm your Medicare number. Medicare does not contact beneficiaries by email or unsolicited phone call to update information.
• **Fake IRS refund notices:** An email says you are owed a tax refund and need to click a link to claim it. The IRS only contacts taxpayers by mail — never by email, text, or social media.
• **Fake package delivery texts:** A text from "UPS" or "FedEx" says your package is held and you need to pay a small fee or confirm your address. If you are not expecting a package, ignore it.
• **Fake Social Security suspension notices:** A call or email says your Social Security number has been suspended due to suspicious activity. This is a scam. The Social Security Administration does not suspend Social Security numbers.

---

What to do if you receive a phishing message

1. 1Do not click any links in the message.
2. 2Do not reply to the message.
3. 3Do not call any phone number listed in the message.
4. 4Report the message (see next section).
5. 5Delete the message.

---

If you accidentally clicked a link or entered information

Do not panic — but act quickly.

1. 1**If you entered a password:** Change that password right away, on all accounts where you use the same password. If it was your email password, change it first.
2. 2**If you entered a credit or debit card number:** Call the number on the back of your card and report it as potentially compromised. Ask your bank to cancel the card and issue a new one.
3. 3**If you entered your Social Security number:** Place a free credit freeze at all three credit bureaus — Equifax (1-800-685-1111), Experian (1-888-397-3742), and TransUnion (1-888-909-8872). A credit freeze prevents new accounts from being opened in your name.
4. 4**Run a security scan** on your computer if you downloaded or opened any file from the message. Windows Defender (built into Windows) can do a free scan.