Phishing
Also known as: Smishing · Vishing · Spear phishing · Phishing scam
A scam in which a fake email, text, call or website impersonating a trusted company or person gets the victim to hand over passwords, account numbers, one-time codes or card details.
Legal basis
FTC, How To Recognize and Avoid Phishing Scams
Phishing casts a lure — an email from "your bank," a text about a missed delivery, a call from "fraud prevention" — and waits for someone to bite. The variants have their own names: smishing by text message, vishing by phone, *spear phishing* when the target is chosen and researched. The FTC's warning applies to all of them: the message tells a story to get a click, and legitimate companies won't email or text a link to update payment information.
What the scam captures is the credential. With a password, a one-time code or card details, the fraudster takes over the account, moves money, or uses the stolen identity to open new accounts and take out credit. The data from one phishing campaign often reappears weeks later in applications elsewhere.
For lenders and platforms, phishing shows up on the other side of the form: a real person's true data, operated by someone else. Checking that the data is valid is not enough. You have to confirm that the person in the flow is the person the data belongs to, and that the device, behavior and network around the application are consistent with that person's history.
Frequently asked questions
How do I report a phishing email or text?
The FTC recommends forwarding phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forwarding phishing text messages to 7726 (SPAM), and reporting the attempt at ReportFraud.ftc.gov. If you gave out information, contact the company involved and, for identity theft, go to IdentityTheft.gov.
How do you spot phishing?
Be wary of messages that create urgency, links whose address does not match the company, unexpected attachments and requests for passwords, codes or card numbers. When in doubt, reach the company by typing its official address or calling the number on your card, never through the message.