Category: Quick Guide / Technology

⚡ Recognizing Online Scams & Phishing

Scammers use emails, text messages, phone calls, websites, social media, and pop-ups to trick people into sending money or revealing private information.

Phishing is a type of scam designed to make you select a harmful link, open an unsafe attachment, provide account information, or approve access to your device.

Use this guide whenever a message or request makes you feel surprised, frightened, rushed, or unsure.

Stop Before You Act

If a message seems suspicious:

1. Do not select any links.
2. Do not open attachments.
3. Do not call a number in the message.
4. Do not reply.
5. Do not provide personal information.
6. Do not send money.
7. Do not approve a login or verification request.
8. Take time to verify the situation independently.

Legitimate organizations will allow you time to confirm a request.

Common Warning Signs

Be cautious when a message:

• Arrives unexpectedly
• Creates fear or urgency
• Threatens arrest, account closure, deportation, or loss of benefits
• Claims you won a prize or refund
• Says you owe money immediately
• Asks for a password or verification code
• Requests payment by gift card, cryptocurrency, wire transfer, or payment app
• Offers a job, investment, loan, or prize that seems too good to be true
• Says a family member is in trouble
• Asks you to keep the situation secret
• Tells you not to contact your bank, family, or police
• Requests remote access to your device
• Contains an unexpected attachment
• Uses an unfamiliar or misspelled website address
• Includes poor grammar or unusual wording

A message can look professional and still be fraudulent.

Scammers Can Pretend to Be Anyone

A scammer may claim to represent:

• Your bank
• A credit card company
• A government agency
• The police or a court
• A delivery company
• A utility company
• A technology company
• A doctor or medical office
• A charity
• A store
• Your employer
• A family member or friend

Caller ID, email addresses, logos, photographs, documents, and social-media profiles can be copied or faked.

Use the Pause-and-Verify Method

Pause

Do not respond immediately, even if the message says the situation is urgent.

Leave the Message

Close the email, text, website, or pop-up. If you are speaking with someone, end the call.

Verify Independently

Contact the person or organization using information you already trust, such as:

• The number on the back of your bank card
• The official app
• A saved contact
• A recent bill or statement
• A website address you type yourself
• A phone number from an official government website

Do not use the link, phone number, or contact information provided in the suspicious message.

Check the Sender Carefully

Look at the complete email address or phone number.

Watch for:

• Misspelled company names
• Extra letters or numbers
• Unusual endings
• A personal email address pretending to represent a business
• A display name that does not match the actual address
• A message from a new number claiming to be someone you know

A familiar name or photograph does not prove that the message is real.

Check Links Without Opening Them

On many computers, you can place the pointer over a link without selecting it. The actual address may appear nearby.

On a phone or tablet, pressing and holding a link may show a preview, but be careful not to open it.

Look for:

• Misspellings
• Extra words
• Strange characters
• An unfamiliar website
• A shortened link that hides its destination

If you are unsure, do not open the link. Go to the organization’s official app or type its known address yourself.

Be Suspicious of Unusual Payment Requests

Scammers often request payment through methods that are difficult to reverse, including:

• Gift cards
• Cryptocurrency
• Wire transfers
• Cash
• Payment apps
• A check followed by a request to return part of the money
• Depositing money into a special “safe” account

Government agencies and legitimate businesses do not demand gift-card numbers as payment.

Never move money to “protect” it because an unexpected caller tells you to.

Never Share Verification Codes

A verification code may arrive by text, email, or an authenticator app.

Do not share it with anyone who contacts you unexpectedly.

A person requesting the code may already have your password and be trying to enter your account.

Also reject login approvals you did not initiate.

Watch for Remote-Access Scams

A scammer may claim that your phone, computer, bank account, or internet connection has a problem.

They may ask you to:

• Install a remote-control app
• Share your screen
• Visit a special support website
• Read numbers from your screen
• Log in to your bank while they watch
• Move money to a secure account
• Pay for unnecessary repairs

Do not provide remote access to anyone who contacted you unexpectedly.

Family-Emergency and Impersonation Scams

Scammers may use personal details, copied voices, or artificial intelligence to pretend to be someone you know.

If someone claims to be in trouble:

1. End the call or stop messaging.
2. Contact the person using a number you already have.
3. Call another family member.
4. Ask a question only the real person would know.
5. Do not send money until you independently confirm the situation.

Do not keep the situation secret simply because the caller tells you to.

If You Received a Suspicious Message

1. Do not interact with it.
2. Take a screenshot if you may need a record.
3. Use the app’s Report Spam or Report Phishing option.
4. Block the sender if appropriate.
5. Delete the message after reporting it.
6. Warn the real person or organization if someone is impersonating them.

Suspicious text messages may be forwarded to 7726, which spells SPAM. Phishing attempts and scams can also be reported at ReportFraud.ftc.gov.

If You Selected a Link but Entered Nothing

1. Close the website.
2. Do not download anything.
3. Update your device and security software.
4. Run a trusted security scan if available.
5. Watch for unusual pop-ups or account activity.
6. Ask for help if the device begins behaving differently.

Selecting a link does not always mean information was stolen, but it is wise to check the device.

If You Entered a Password

Using a trusted device:

1. Go directly to the real website or official app.
2. Change the password immediately.
3. Make the new password long and unique.
4. Change it anywhere else you reused it.
5. Turn on multifactor authentication.
6. Sign out of other devices and active sessions.
7. Review the account for unfamiliar changes.
8. Start with your email account if it was affected.

Do not use another link from the suspicious message to change the password.

If You Shared Financial or Personal Information

Act quickly if you shared:

• Bank or credit card information
• A Social Security number
• Identification documents
• Medical information
• Account credentials
• Verification or recovery codes

Contact the affected bank, company, or agency using a verified number. Ask what immediate protections are available.

Visit IdentityTheft.gov for a recovery plan if personal information may be used for identity theft.

If You Sent Money

1. Contact your bank, card issuer, payment app, wire-transfer company, or gift-card company immediately.
2. Explain that you paid a scammer.
3. Ask whether the payment can be stopped or reversed.
4. Secure the account.
5. Save receipts, messages, usernames, and transaction information.
6. Report the scam at ReportFraud.ftc.gov.
7. Contact local law enforcement if appropriate.

Recovery is not guaranteed, but acting quickly may improve your chances.

Be cautious of anyone who promises to recover your money for an upfront fee. This may be another scam.

If Someone Had Remote Access

1. Disconnect the device from the internet.
2. End the remote-access session.
3. Do not log in to financial accounts from that device.
4. Uninstall the remote-access software if you can do so safely.
5. Run a trusted security scan.
6. Ask a qualified technician to inspect the device.
7. Change important passwords from a different trusted device.
8. Contact financial institutions if banking information was visible.
9. Review accounts for unauthorized activity.

Do not reconnect the device until you are confident it is safe.

Quick Scam Check

Before responding to an unexpected message, ask:

• Was I expecting this?
• Is the sender pressuring or frightening me?
• Am I being asked for money or private information?
• Is the payment method unusual?
• Am I being told to keep something secret?
• Does the sender want a password or verification code?
• Does the link or address look unusual?
• Can I verify this through a separate trusted source?

If even one answer concerns you, stop and verify before doing anything.

Remember

You are not rude for ending a call, ignoring a message, or asking someone you trust for help.

Scammers depend on urgency, fear, excitement, and embarrassment. Taking a few minutes to pause and verify can protect your money, identity, accounts, and devices.

Helpful Resources: Browse Safe Online Activity for products, equipment, services, or supplies related to this section.