What Is Phishing? How to Spot, Avoid and Report Phishing Scams
Phishing is the most common cybercrime reported to the FBI, and it is usually the first step in bigger crimes such as account takeovers, ransomware and business email fraud. This explainer covers what phishing is, the forms it takes, the warning signs to look for, and what to do if you click a bad link. It is written for both individuals and small businesses.
What Is Phishing?
Phishing is a scam in which a criminal poses as someone you trust, such as a bank, delivery company, employer, government agency or even a friend. The goal is to get you to give up information or money, or to install malicious software. The message usually tries to get you to do one of these things:
- Click a link to a fake login page that captures your username and password
- Open an attachment that installs malware
- Reply with personal data, such as account numbers or one-time security codes
- Send money, gift cards or cryptocurrency, or change payment instructions
The Federal Trade Commission’s consumer guidance notes that phishing messages often tell a convincing story to get you to act quickly. Examples include a problem with your account, a suspicious login, an unpaid bill or a package that could not be delivered.
How Big Is the Phishing Problem?
The FBI Internet Crime Complaint Center’s 2025 Internet Crime Report was released in April 2026. Here are its key figures, as summarized by Help Net Security and dmarcian:
| Measure (2025) | Figure |
|---|---|
| Phishing/spoofing complaints | 191,561, the most of any crime type |
| Total complaints to IC3 | More than 1 million |
| Total reported losses, all crimes | About $20.9 billion, up 26% |
| Business email compromise losses | About $3.05 billion |
| Complaints involving AI | More than 22,000, with nearly $893 million in losses |
Phishing complaints often show small direct losses because the phish itself is just the entry point. The money is lost later, through stolen accounts, wire fraud or ransomware that began with a single click.
Common Types of Phishing
| Type | How it arrives | Typical example |
|---|---|---|
| Email phishing | Mass email | “Your account has been locked. Verify now.” |
| Spear phishing | Targeted email that uses personal details | A message to a finance employee that names a real vendor |
| Smishing | Text message (SMS) | Unpaid toll, package delivery or bank-alert texts |
| Vishing | Phone call or voicemail | A caller posing as your bank’s “fraud department” |
| Business email compromise (BEC) | Spoofed or hijacked business email | “Please update our wire instructions before Friday’s payment.” |
| QR-code phishing (“quishing”) | QR code in an email, flyer or parking sign | A code that opens a fake payment page |
| AI-assisted phishing | Any channel | Polished messages without typos, or cloned voices on calls |
How to Spot Phishing: 8 Warning Signs
These signs come from guidance published by the Cybersecurity and Infrastructure Security Agency (CISA) and the FTC.
- Urgency or threats. “Act within 24 hours or your account will be closed.”
- Sender mismatch. The display name says “PayPal,” but the actual address or domain is something else.
- Links that do not match. On a computer, hover over the link. On a phone, long-press it. Check where it really goes.
- Requests for codes or passwords. Legitimate companies do not ask you to read back a one-time code they just sent you.
- Unusual payment methods. Requests for gift cards, crypto, wire transfers or payment apps are major red flags.
- Unexpected attachments. Be especially wary of invoices, “scanned documents” or shipping labels you were not expecting.
- Generic greetings. “Dear Customer” in place of your name can be a sign, though targeted phishing will often use your name.
- Too good to be true. Prizes, refunds or investment returns you never applied for.
One important caveat is that AI tools have made spelling and grammar mistakes a much less reliable warning sign. Judge a message by what it asks you to do, not by how polished it looks.
How to Protect Yourself From Phishing
For individuals
- Go direct. Do not use the link or phone number in the message. Type the company’s address yourself or use its official app.
- Use phishing-resistant sign-in. Passkeys and hardware security keys will not work on fake sites. See our guide, What Are Passkeys?
- Turn on multi-factor authentication wherever passkeys are not yet offered.
- Use a password manager. It will not autofill your password on a look-alike domain, which is a useful built-in warning.
- Keep devices updated so malicious attachments have fewer flaws to exploit.
For businesses
- Verify payment changes out of band. Call a known number before changing any wire or ACH instructions.
- Set up email authentication (SPF, DKIM and DMARC) so criminals have a harder time spoofing your domain.
- Train staff with realistic examples and make reporting easy, with no blame for honest mistakes.
- Vet vendors and partners. Attackers often phish through a trusted supplier. See Supply Chain Cyberattacks.
What to Do If You Clicked a Phishing Link
- Stop. Do not enter any more information, and close the page.
- Change your password for that account and for any account that uses the same password. Start from a clean device if you can.
- Sign out of other sessions and check your account’s security settings for unfamiliar devices, forwarding rules or recovery details.
- Call your bank or card issuer right away if you shared financial information or sent money. Speed matters for recovering funds.
- Scan your device with up-to-date security software if you opened an attachment.
- Tell your IT team at once if it was a work account.
Where to Report Phishing
- Phishing emails: Forward them to the Anti-Phishing Working Group at reportphishing@apwg.org, and use your email provider’s “Report phishing” button.
- Scam texts: Forward them to 7726 (SPAM), as the FTC recommends.
- Fraud and losses: File reports at ReportFraud.ftc.gov and with the FBI at IC3.gov.
- Identity theft: Get a recovery plan at IdentityTheft.gov.
Phishing FAQ
Can you get hacked just by opening a phishing email?
For most people on updated software, opening an email is low risk. The danger comes from clicking links, opening attachments, scanning embedded QR codes or replying.
How is phishing different from spam?
Spam is unwanted bulk messaging, often advertising. Phishing is deliberately deceptive and is designed to steal credentials, money or access.
Does multi-factor authentication stop phishing?
It helps a great deal, but codes sent by text or app can still be phished in real time. Passkeys and hardware security keys are considered phishing-resistant because they only work on the real website.
For more on how stolen access turns into bigger attacks, read Double Extortion Ransomware and our report on AI tools suspected in South Korea bank hacks.
Fact labels: Statistics come from the FBI IC3 2025 report as summarized by the linked publications. The warning signs and reporting steps reflect published FTC and CISA guidance. The protection tips are general best practices, not a guarantee against fraud.
Publisher Disclaimer: Vanderbiltreport.com publishes news and information for general informational and educational purposes. Information is compiled from sources believed to be reliable, but Vanderbiltreport.com does not guarantee the accuracy, completeness, or timeliness of all information presented. Readers should independently verify information and conduct their own research before making financial, investment, business, or other decisions.
