You probably know the classic phishing email.
Bad grammar. Strange formatting. A suspicious link. Maybe an unexpected message telling you you’ve won something you definitely don’t remember entering.
Easy enough to spot, right?
Today’s phishing scams aren’t always that obvious.
A phishing message can be professionally written, personalized and filled with details that make it look legitimate. Artificial intelligence is making it easier for scammers to create convincing communications—and phishing can reach you through a lot more than email.
A text message.
A phone call.
A social media message.
A fake website.
Even a message that appears to come from someone you know.
Phishing has changed. Knowing what to watch for can help you change with it.
First Things First: What Is Phishing?
Phishing is a scam designed to get you to do something you otherwise wouldn’t.
That could mean revealing sensitive information, clicking a malicious link, opening an attachment, sending money or providing access to an account.
The scammer wants you to believe the request is legitimate long enough to act on it.
And these days, making something look legitimate is getting easier.
Don’t Judge a Message by Its Grammar
Poor spelling and strange wording used to be some of the easiest ways to spot a scam.
Don’t count on them anymore.
Artificial intelligence can help scammers write polished messages, personalize their communications and imitate the way legitimate businesses and people communicate.
The message might use your name.
It might know where you work.
It could mention your bank, a company you use or another detail that makes you think, “This must be real.”
Maybe it is.
But instead of trusting how the message looks, ask yourself:
Was I expecting this?
And if not:
Can I verify it another way?
Email Phishing: The Classic Scam With a New Look
Email phishing is still common.
The message may appear to come from a bank, retailer, delivery company, government agency or another organization you recognize.
Maybe your password supposedly expired.
There’s a problem with your payment.
You need to review a transaction.
Your account needs to be verified.
Whatever the story, there’s often a link waiting for you.
That link may lead to a fake website designed to capture your login credentials or other sensitive information.
Instead of clicking, go directly to the company’s website or app yourself.
Smishing: The Scam in Your Text Messages
“Your package couldn’t be delivered.”
“Your account has been locked.”
“Your payment was declined.”
A quick text can create just enough concern or curiosity to make you tap the link without thinking much about it.
That’s smishing—phishing delivered through a text message.
We’re used to companies communicating with us by text, which can make these messages particularly easy to mistake for the real thing.
Before tapping, stop.
If the message is supposedly about an account you use, open the official app or website yourself and see if there’s actually a problem.
Vishing: When Phishing Calls You
Yes, phishing can happen over the phone.
It’s sometimes called vishing.
Someone may call claiming to be your bank, a government agency, a business or another organization you know.
They might need to “verify” some information. Maybe they ask you to read back a code. Maybe they tell you there’s a problem with your account that needs immediate attention.
The caller may even know information about you.
And caller ID isn’t enough to prove who is actually on the phone.
If you’re unsure, hang up and call the organization yourself using a number you know is legitimate.
Spear Phishing: When the Scam Is About You
Some scammers cast a wide net.
Others do their homework.
Spear phishing is targeted at a particular person or organization.
A scammer may use information about your job, company, relationships or online activity to make the message seem more relevant.
If you own a business, maybe the email appears to come from a vendor you work with.
If you’re an employee, perhaps it looks like your manager sent it.
If you’re a customer, it might appear to come from your bank.
A message being specific doesn’t make it legitimate.
In fact, the more targeted the request is, the more important it is to independently verify it.
Businesses Get Phished, Too
Phishing can be more than an inconvenience for a business.
A fraudulent communication could appear to be:
- An invoice
- A vendor request
- A payment notification
- An employee survey
- A partnership opportunity
- A message from an executive
- An account security notification
The goal could be to steal an employee’s login credentials, gain access to a business account or convince someone to make a payment or financial change.
A good business process shouldn’t depend on someone being able to “spot the scam.”
Build verification into the process instead.
Most Phishing Scams Have a Few Things in Common
The story may change, but the tactics often don’t.
It’s urgent.
You’re told to act now.
There’s pressure.
You’re discouraged from slowing down or checking with someone else.
The request is unexpected.
Someone wants information, a login, a payment or another action you weren’t anticipating.
Something isn’t quite right.
The email address, phone number or website may look close to the real thing—but not exactly.
They want sensitive information.
You’re asked for a password, authentication code, Social Security number or financial information.
It looks familiar.
A company, organization or person you know appears to be behind the communication.
That last one is important.
Familiar Isn’t the Same as Verified
Scammers can copy logos.
They can build fake websites.
They can spoof contact information.
And sometimes, legitimate email or social media accounts can be compromised.
So even when something looks familiar, pay attention to what you’re being asked to do.
If it involves your money, personal information or access to an account, verify before you act.
Give Yourself a Second Before You Click
A lot can happen with one click.
So when an unexpected message asks you to do something:
Stop.
Don’t click the link or open the attachment just to see what it is.
Check.
Look at who’s contacting you and what they’re asking you to do.
Verify.
Go directly to the official website or app, or call a number you already trust.
Don’t use the contact information in a suspicious message to verify whether that message is legitimate.
Make Yourself a Harder Target
A few everyday habits can make a difference:
- Use different, strong passwords for your accounts.
- Turn on multifactor authentication.
- Keep software and devices updated.
- Be cautious with unexpected links and files.
- Navigate directly to websites when you’re unsure.
- Review alerts about unusual account activity.
- Verify unexpected requests involving money or sensitive information.
None of those steps requires you to become an expert in cybersecurity.
They’re simply good habits.
Clicked Something You Shouldn’t Have?
It happens.
If you think you entered information into a phishing site, change the compromised password as soon as possible.
If you’ve reused that password anywhere else, change it there, too.
Enable multifactor authentication if you haven’t already, monitor your accounts for unusual activity and notify the organization that was impersonated.
And if you downloaded something suspicious, consider running a malware scan.
The sooner you act, the sooner you can start limiting the potential damage.
Phishing Has Changed. Your Response Can, Too.
You can’t assume a scam will announce itself with terrible spelling and an obviously fake email anymore.
It might look professional.
It might know your name.
It might arrive from a familiar-looking number or account.
And it might show up somewhere you weren’t expecting.
But you don’t have to figure everything out in the moment.
Stop. Check. Verify.
When your money, information or accounts are involved, taking a few extra seconds to make sure you’re dealing with the right person is time well spent.