What Is Phishing? A Plain-English Guide

You’ve probably heard the word “phishing” — maybe in a warning from your bank or your email provider. But what does it actually mean, and how do you protect yourself? Here’s a plain-English explanation.

Phishing, defined

The Federal Trade Commission describes phishing as scammers using email or text messages to trick you into giving them your personal and financial information — your passwords, account numbers or Social Security number. With that information, they could get into your email, bank or other accounts, or sell your information to other scammers.

The FBI’s Internet Crime Complaint Center (IC3) groups phishing with spoofing: unsolicited emails, texts and phone calls that pretend to come from a legitimate company to get personal, financial or login information. It’s the most-reported internet crime in the country: in 2025, phishing and spoofing was the top crime type by number of complaints, with 191,561 reports.

How a phishing attack works

Most phishing attacks follow the same three steps:

1. The bait. A message that looks like it comes from a company you know — a bank, credit card company, utility, online payment service or delivery company. It tells a story: suspicious activity, a payment problem, an invoice, a refund, a free gift.
2. The hook. It asks you to act: click a link, open an attachment, log in, call a number, or “confirm” your information.
3. The catch. The link leads to a fake website that looks real, where anything you type goes to the scammer. Or the attachment installs harmful software (malware) that can steal your information without you noticing.

EXAMPLE — SCAM

Today 9:20 AM●●● ▮

# (312) 555-0143 Text message

Your account has been temporarily locked after 3 failed sign-in attempts. Restore access now: https://account-restore.example.com/login

The many forms of phishing

Phishing started with email, but today it arrives many ways:

• Email phishing. The classic version: a message with a link or attachment. See real phishing email examples.
• Text-message phishing (“smishing”). Fake package, toll and bank-alert texts. The U.S. Postal Inspection Service uses the word “smishing” for fake package-tracking texts. See scam text messages.
• Phone phishing (“vishing”). A caller or recording pretends to be your bank, a government agency or tech support. Caller ID can be faked, the FCC warns. See phone scams.
• Fake websites. Look-alike sites, often reached through search ads or social media. See how to check if a website is legit.
• QR code phishing. In September 2026 the FTC warned that scammers are putting their own QR codes over real ones on parking meters, sending people to fake payment sites.
• Consent phishing. In September 2026 the FBI described a newer trick, mostly aimed at prominent people and their families: a link leads to a real login page, then asks you to approve a permission request from an app controlled by the attacker. If you approve it, the app can access your email or files without ever learning your password — and changing your password doesn’t remove that access. The FBI’s advice: be wary of messages from unfamiliar numbers or accounts, verify the sender independently, and only authorize apps you trust.

Why phishing works — even on careful people

Phishing messages are designed to make you react before you think. CISA, the federal cybersecurity agency, says they often use urgent or emotionally appealing language — especially warnings of dire consequences if you don’t respond immediately.

And the old clues are fading. CISA notes that poor spelling and grammar used to give phishing away, but AI can now produce flawless messages. The FTC adds that a real company’s logo in a message doesn’t prove it’s legitimate.

Phishing warning signs

CISA and the FTC point to these signs:

• Urgent or emotional language that claims bad things will happen if you don’t act now.
• Requests for personal or financial information.
• Untrusted, shortened links, or links that don’t match the company’s real website.
• Incorrect addresses — CISA gives the example of a look-alike such as “amazan.com.”
• A message about an account you don’t have, or a charge you don’t recognize.
• A link to update your payment information — the FTC says legitimate companies won’t email or text you one.

Phishing safety: how to protect yourself

The FTC recommends four layers of protection:

1. Use security software on your computer and set it to update automatically.
2. Keep your phone’s software updated automatically.
3. Use multi-factor authentication. It requires two or more ways to prove it’s you — something you know (a password or PIN), something you have (a code from a text or app, or a security key), or something you are (a fingerprint or face scan). A stolen password alone then isn’t enough.
4. Back up your data on your computer and phone, to an external hard drive or the cloud.

And one habit beats them all: when a message asks you to act, go to the company yourself. The FTC’s test is simple — do I have an account with this company, or know the person who contacted me? If not, it could be phishing. If so, contact them using a phone number or website you know is real, not the contact information in the message.

What to do with a phishing message

CISA’s three steps: recognize the warning signs, resist the urge to click, and delete the message — without replying or clicking anything, even “unsubscribe.” Before you delete it, report it:

• Phishing email: forward it to the Anti-Phishing Working Group at reportphishing@apwg.org, and use your email’s “Report phishing” button. See how to report a phishing email.
• Phishing text: forward it to 7726 (SPAM). See how to report a scam text.
• Any phishing attempt: report it to the FTC at ReportFraud.ftc.gov.

If you already responded

• Clicked a link or opened an attachment: update your security software, run a scan and delete anything it flags.
• Gave away a password: change it right away, and anywhere else you used it.
• Shared your Social Security, credit card or bank account number: go to IdentityTheft.gov for steps based on what was exposed.

Our first-hour checklist walks you through each step.