What Is Phishing: How to Spot Phishing Emails

Many people fall victim to phishing, a type of scam in which attackers trick people into giving up personal or financial information or access to their accounts or devices. Learn how phishing works, how to spot phishing emails and other scams, and what to do if you click a suspicious link.

If you want to avoid becoming a victim of a phishing scam, it helps to understand how phishing works, recognize the warning signs, and know what to do if you click a phishing link.

The Short Version

Be wary of any unexpected message that pressures you to act fast.
Don't click links, open attachments, or call numbers in a message you weren't expecting.
To check a message, contact the company directly. Use its official website or app, or a phone number you already know.
UFCU will never contact you unexpectedly to ask for your digital banking username or password, PIN, or Social Security number.

How Does Phishing Work?

Fraudsters can buy or steal your email or phone number. They can then send you messages that seem to come from trusted companies asking for personal information. Their messages can look exactly like real emails and websites. The messages may contain urgent warnings to make you click quickly on a link they provide.

If you click a link without thinking, phishing software can load malware (a damaging program or virus) that can harvest data from your computer or mobile device. Another tactic is to get you to provide your account numbers, identifying information, or other data on a web page that looks legitimate. After criminals get your information, they can use it to steal your identity and your money.

These are some common types of phishing attacks:

Email Phishing: A scammer sends an email pretending to be a reputable bank or company. The email often includes a link to a fake website.
Spear Phishing: People or organizations receive an email that is designed specifically for them, based on detailed research. The message is personalized, so it’s more convincing.
Smishing or SMS phishing: Victims get a text message that persuades them to provide their login information or click a link that installs malware.
Vishing, or voice fishing: A real person calls victims by phone and convinces them to share personal information.
QR code phishing ("quishing"): A scammer uses a fake QR code, such as a sticker on a parking meter, a flyer, a package, or a code in an email, to send you to a fake website that asks for your payment or login information.
Callback phishing: An email or text warns you about a charge, subscription renewal, or account problem you don't recognize and gives you a phone number to call. The person who answers is a scammer who tries to get your account information, payment, or access to your device.

Criminals who use phishing take advantage of two things: human feelings and outdated technology.

How to Spot a Phishing Email

Phishing emails can look surprisingly legitimate. They may use familiar names, logos, and branding to make you feel comfortable clicking a link or responding. Before you take action, slow down and look for signs that the message may not be what it seems. Common phishing email signs include:

Urgent or threatening language. A message may pressure you to act immediately or claim something bad will happen if you don’t.
Requests for sensitive information. Be suspicious of unexpected requests for passwords, account numbers, Social Security numbers, one-time passcodes, or other personal or financial information.
A suspicious sender address. Check the sender’s email address carefully. It may look similar to a legitimate address but contain slight changes or unusual characters.
Unexpected links or attachments. Don’t click links or open attachments you weren’t expecting.
Mismatched or suspicious URLs. A link may appear to lead to a familiar website but actually direct you somewhere else.
Spelling or grammar mistakes. Errors can be a warning sign, although sophisticated phishing emails may contain few or no obvious mistakes.
An unexpected problem, payment request, or prize. Scammers may claim there’s a problem with your account, payment, or delivery—or tell you you’ve won something—to get you to act quickly.

If you’re unsure whether a message is legitimate, don’t use the links or contact information in the message. Instead, go directly to the organization’s official website or use a phone number you already know is legitimate to verify the message.

How Phishing Uses Social Engineering

Phishing attacks that target human emotions use social engineering. Social engineering is a tactic that plays on feelings like trust, opportunism, and fear to get victims to take action.

Attackers know they have a better chance of success when victims feel urgency, sympathy, familiarity, or a relationship with the sender. An attacker might pretend to be a well-known retailer or local utility. For instance, they might send an email that appears to come from Amazon or Google and asks you to verify account information. In these cases, the attacker is “spoofing” the well-known company. Spoofing is a common tool used in phishing attacks.

The goal is to not raise the victim’s suspicions and to trick recipients into taking action quickly, without thinking. For this reason, many employers have rules that prohibit employees from opening external links and unusual emails. Data breaches, in which fraudsters steal large amounts of customer or patient data, can occur if malware infects a business or organization’s computer system through social engineering.

What are the signs of social engineering?

Social engineering uses words to create a sense of urgency or fear. Techniques such as threats and free offers or promotions are common. For example, a phishing email may claim that if you don’t respond immediately, the company will close your account. Or it might offer fake rewards on a short deadline.
Spoofed messages often request your username, password, or credit card details to “resolve” an issue. They ask for information that real government offices, utilities, banks, and retailers don’t ask for.

Messages may contain typos or awkward phrasing to bypass spam filters.
The sender’s address might resemble a trusted entity but with slight variations.

Fake websites often mirror legitimate sites almost perfectly. Phishing emails or messages may contain links that direct you to fake sites, where they hope you will provide your personal data.

To protect yourself, learn the signs of phishing. Individuals and businesses can take steps to defend against these threats if they understand the tactics used in phishing attacks. It’s crucial to stay informed to avoid falling victim to this type of cybercrime.

Phishing Text Messages: What Is Smishing?

Smishing is phishing delivered through a text message, or SMS. A scammer may send a message that appears to come from a bank, delivery company, government agency, or another trusted organization. Be cautious of unexpected text messages that:

Create a sense of urgency
Ask for personal or financial information
Ask you to click a link
Claim there is a problem with your account, payment, or delivery
Offer a prize, refund, or other unexpected benefit

If you receive a suspicious text, don’t click its links or use the phone number provided in the message. Instead, contact the organization directly using information you know is legitimate.

Phishing vs. Spoofing: What’s the Difference?

Phishing and spoofing are related, but they’re not the same thing.

Phishing is the scam attempt — the fraudulent email, text, phone call, or other message designed to trick you into giving up information or taking an action.

Spoofing is the disguise. A scammer may spoof a company’s name, email address, phone number, or website to make a phishing message appear legitimate.

Understanding both can help you recognize suspicious communications before you respond.

How to Protect Yourself From Phishing Scams

Scammers continually change their tactics, so staying alert is an important part of protecting your information and money. You can reduce your risk by:

Keeping your operating system, browser, and apps updated. Updates often include security fixes that help identify and block malware.
Using spam and security filters and turning on the privacy and security settings on your devices.
Paying attention to security warnings from your device, browser, or email provider, such as a warning that a sender or website may be suspicious.
Enabling multi-factor authentication (a second step, like a code, in addition to your password) or passkeys on accounts that offer it.
Using strong, unique passwords for each of your accounts.
Being cautious with unexpected emails, texts, attachments, and links.
Going directly to a company's website or app instead of clicking a link in an unexpected message.

Filters and warnings catch a lot, but not everything, so it still pays to stay alert.

What to Do If You Clicked on a Phishing Link

Wondering what to do if you clicked a phishing link in an email or text? It happens to careful people, and acting quickly can limit the damage. What to do next depends on what happened after you clicked.

If you shared a UFCU code, login, or card number, or sent money

Call UFCU Member Services right away at (512) 467-8080 or (800) 252-8311. The sooner we know, the more we can do to help protect your account and money.
Lock your debit or credit card in the UFCU Mobile app while you sort things out.
Change your UFCU Online Banking password if you shared it or typed it into a fake site.
If you lost money, see our page about [options if you have lost money].

If you entered a password or other personal information on a website

Change that password right away. If you used the same password anywhere else, change it there too, starting with your email and financial accounts.
Turn on multi-factor authentication (a second step, like a code, in addition to your password) for accounts that offer it.
Watch your accounts for activity you don't recognize.
If you shared your Social Security number or other identifying information, consider a credit freeze (see below).

If you downloaded a file, installed an app, or let someone connect to your device

Disconnect your device from the internet (turn off Wi-Fi and mobile data).
Remove any app a scammer asked you to install, especially remote-access or screen-sharing apps.
Update your security software and run a scan. Follow its recommendations if it finds a problem
Change your passwords using a different device that you know is safe.
Get help from a trusted technical professional if you can't remove the problem yourself.

If you clicked but didn't enter anything

Close the page and don't download anything it offers.
Run a security scan to be safe and keep an eye on your accounts.

Protect yourself going forward

Turn on account alerts so you're notified of unusual activity.
Check your credit report regularly. You can get free reports at AnnualCreditReport.com, and UFCU's Credit Coach program makes it easy to keep track.
Consider a credit freeze. It's free at Equifax, Experian, and TransUnion, and it stops anyone from opening new credit in your name.
If your identity has been stolen, visit IdentityTheft.gov for a step-by-step recovery plan.

Report it

Reporting helps stop scammers and protect others:

Scam texts: Forward them to 7726 (SPAM), then use "Report Junk" in your messages app.
Phishing emails: Use your email app's "Forward the email to reportphishing@apwg.org.”
Any scam: Report it to the Federal Trade Commission at ReportFraud.ftc.gov.
If you lost money: Also file a report with your local police.
Messages pretending to be UFCU: Let us know by calling Member Services.

How Your Financial Institution Combats Phishing

Your security is one of our top concerns. Like most financial institutions, UFCU never requests sensitive information by phone or email. Our employees follow strict policies when verifying account ownership over the phone and at our branches. We provide a secure communication channel in our Online Banking and Mobile app.

You can immediately change your password on our site 24/7. Our Mobile app allows you to change your credit or debit card PIN and lock your cards whenever you choose. If fraud forces you to change your card number, replacements are available on a same-day basis at any branch.

We offer helpful articles (like this one) and other assistance to help you fight fraud and build good defenses for your data and your money. Working together, we can keep attackers far from your funds.

Recognize and Respond to Phishing

If you receive a phishing message, act quickly to prevent identity theft and financial loss.

Look for poor grammar or misspellings in communications from a legitimate website or organization.
Beware of urgent language meant to create panic.
Be suspicious of requests for your financial information, passwords, or social security numbers.
Always verify email addresses closely and check for mismatched URLs. If you are on a computer, use your mouse to hover over hyperlinks to verify their legitimacy.
Investigate any links before clicking; malicious links often look real but may lead to a harmful site. Or better yet, go to the organization’s official site or platform to check on your account status.

If Phishing Happens to You

If a phishing email tricks you into clicking a suspicious link, take action immediately.

Disconnect your device from the internet to stop further data transmission.
Change your passwords, focusing on financial websites first.
Report fraud to your financial institutions. To report to UFCU, contact Member Services at (512) 467-8080 or (800) 252-8311. Also see our web page about options if you have lost money.
Enable security alerts on your accounts to monitor suspicious activities.
Request and review your credit report on a regular basis. UFCU provides a way for you to do this easily through our Credit Coach program.
Consider purchasing identity theft protection services to watch for misuse of your personal information.
Report any incidents to law enforcement. Notify anti-phishing groups¹ and file a report with the Federal Trade Commission to help combat scammers.

Frequently Asked Questions About Phishing

What is phishing?

Phishing is a type of scam in which criminals impersonate a trusted person, company, or organization to trick you into providing personal or financial information, clicking a malicious link, opening an attachment, or taking another action that could put your information or accounts at risk.

How can I tell if an email is phishing?

Look for warning signs such as urgent or threatening language, unexpected requests for personal or financial information, suspicious sender addresses, unexpected links or attachments, and mismatched URLs. If you’re unsure, don’t click anything in the message. Contact the organization directly using a phone number or website you know is legitimate.

What should I do if I clicked a phishing link?

Act quickly. If you entered a password or other sensitive information, change the compromised password and enable multi-factor authentication if available. If you downloaded something or think malware may have been installed, update your security software and run a scan. If financial information was exposed, contact your financial institution directly.

How can I tell if a text message is a phishing scam?

Be cautious of unexpected text messages that create a sense of urgency, ask for personal or financial information, or tell you to click a link. Don’t use links or phone numbers provided in a suspicious message. Instead, contact the company directly using information you know is legitimate.

What is the difference between phishing and spoofing?

Phishing is the scam attempt designed to trick you into taking an action or providing information. Spoofing is a technique scammers use to make a message, phone number, email address, or website appear to come from someone you trust.

Will UFCU ask me for my password or one-time passcode?

UFCU will never unexpectedly contact you to ask for your digital banking username and password, PIN, or Social Security number. If you call UFCU Member Services, a representative may ask you to provide a one-time passcode to verify your identity.

For example, https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams