The short answer: a phishing email pretends to be from a company you trust so that you’ll click a link, open an attachment, or hand over a password or account number. Before you click, ask yourself: do I actually have an account with this company, and was I expecting this? If you’re not sure, don’t use anything in the email. Go to the company’s website or call it on a number you know (FTC).
Why it matters
In 2025, people 60 and older filed 48,064 phishing and spoofing complaints with the FBI. Older Americans reported $7.7 billion in losses to all kinds of online crime that year (FBI IC3 2025 report). Many big scams start with a single email.
The warning signs
The FTC says phishing messages often (FTC):
- say there’s suspicious activity or a login attempt on your account
- claim there’s a problem with your account or payment information
- ask you to “confirm” personal or financial information
- include an invoice you don’t recognize
- want you to click a link to make a payment
- say you’re owed a government refund
- offer a coupon or something free
Other giveaways: a generic greeting like “Dear Customer,” a message saying your account is “on hold,” and a link to “update your payment details.” Real companies won’t email or text you a link to update payment information (FTC).
Check before you click
- Look at the sender’s full address, not just the name. A message from “Amazon” sent from a strange or misspelled address is fake.
- On a computer, rest your mouse over a link without clicking. The real web address shows in the corner of the screen. If it doesn’t match the company, don’t click.
- Don’t open attachments you weren’t expecting. They can install harmful software (FTC).
Four ways to protect yourself
- Use security software on your computer and let it update automatically.
- Set your phone to update automatically.
- Turn on multi-factor authentication (a password plus a code) for email, banking and shopping accounts.
- Back up your files and photos (FTC).
If you clicked or replied
- If you gave away your Social Security, card or bank number, go to IdentityTheft.gov for steps based on what you shared (FTC).
- If you opened an attachment or link, update your security software, run a scan, and remove anything it finds (FTC).
- If you typed a password, change it on the real website, and anywhere else you used it.
Report it
- Forward phishing emails to the Anti-Phishing Working Group at [email protected].
- Forward phishing texts to 7726 (SPAM).
- Report it to the FTC at ReportFraud.ftc.gov (FTC).
- Use your email program’s “Report phishing” or “Report junk” button, then delete the email.
