Phishing
Also called: phishing scam
Phishing is a scam in which someone poses as a trusted company, agency or person, usually by email or text, to trick you into revealing passwords, account numbers or Social Security numbers, or into clicking a harmful link.
By Beacon · Updated
How it works
Phishing messages usually tell a story that calls for quick action: suspicious activity on an account, a problem with your payment information, an invoice you do not recognize, a refund from a government agency, or a free prize or coupon. The goal is to get you to click a link, open an attachment, or hand over personal or account information.
A useful first question is whether you actually have an account with the company or know the sender. If not, it could be phishing: check for the warning signs, then report and delete the message. If so, contact the company through a phone number or website you already know is real, rather than the details in the message. Security software, automatic updates, multi-factor authentication and backups of your data add protection if a message gets through.
If you already responded, the next steps depend on what you shared, and IdentityTheft.gov lists steps by type of information exposed. If you clicked a link or opened an attachment, updating your security software and running a scan can help. You can report phishing to the FTC at ReportFraud.ftc.gov and forward scam texts to 7726 (SPAM).
Related terms
Sources and further reading
Examples are illustrative and focus on U.S. personal finance. This page is educational, not individual financial, investment, tax, or legal advice. Read our editorial approach or report a correction.