🎣 Spotting phishing: four fake messages taken apart line by line

🎯 In 30 seconds: Phishing messages copy real companies well, so don’t judge by the logo. Judge by what the message wants: a click, a call, a code, a payment or a secret, usually in a hurry. When a message asks for any of those, close it and reach the company through an address or number you already know.

What every phishing message has in common

The details change every month, but the shape doesn’t. A phishing message creates a feeling (fear, urgency, excitement or helpfulness) and then gives you one easy action that moves you off the safe path. The four messages below are made up for this page; the companies and people in them don’t exist. Each warning sign is numbered.

Example 1: the text from “your bank”

“HARBOR POINT BANK: A charge of $1,248.00 at ELECTRO-MART was flagged. If this was NOT you, reply NO or verify at hpb-secure-alerts.co within 30 min to avoid account lock.”

1. The amount is large and specific so you feel the loss before you think.
2. A deadline (“within 30 min”) to stop you from calling the bank.
3. The web address isn’t the bank’s. A real bank uses its own domain, not a look-alike with “secure” or “alerts” added.
4. “Reply NO” tells the sender your number is live and can lead to a call from a fake “fraud department” that asks for the code the bank just texted you.

Safe move: open your bank’s app or call the number on the back of your card. If the charge is real, the bank will see it there too.

Example 2: the delivery that “couldn’t be completed”

“Your parcel is on hold at our depot due to an incomplete address. A $1.95 redelivery fee is required. Update here: parcel-redeliver-us.info/track”

1. A tiny fee feels harmless, but the form asks for your full card number, expiry and security code.
2. No tracking number, no sender name and no carrier name you can check.
3. An odd domain ending such as .info or .top on a message pretending to be a national carrier.

Safe move: copy the tracking number from the store’s order email and paste it into the carrier’s own site.

Example 3: the renewal invoice with a phone number

“Thank you for renewing PC ShieldGuard Total Care. $399.99 will be charged today. To cancel or dispute, call our billing desk at the number below.”

1. A product you never bought, so you call to complain.
2. No link at all, which slips past filters that look for bad links. The phone number is the trap.
3. On the call, the “agent” asks you to install a remote-access app to “process the refund.”

Here is the numbers trick that usually follows. The agent says they will refund $39.99, then types $3,999 into a fake form while they control your screen. Your account appears to show the extra money (it is often just your own savings moved into checking). They say you were overpaid by $3,959.01 and must send it back by gift cards, wire or a crypto machine. Nothing was ever refunded; the only real money that moves is yours.

Example 4: the message from your boss

“Are you at your desk? I’m in meetings all day and need a favor. Pick up five $200 gift cards for client thank-yous and send me photos of the backs. I’ll reimburse you. Keep this between us for now.”

1. The sender’s name is right but the address is a free personal account, or a reply-to that differs from the sender.
2. “In meetings all day” stops you from calling to check.
3. Gift cards and secrecy: $1,000 in cards that can be spent the moment the codes arrive.

Safe move: confirm through a different channel, such as a call to the number in the company directory.

Reading a web address in five seconds

Find the first single slash after the “https://”. Look at the part just before it. Read that part from right to left: the last two pieces are who really owns the site.

A padlock icon only means the connection is encrypted. Scam sites have padlocks too.

Where to report

• Scam texts: forward them to 7726 (it spells SPAM), then delete.
• Scam emails: use your email program’s “report phishing” button. The FTC also lists a forwarding address for the Anti-Phishing Working Group on its phishing page.
• Any attempt, especially one that cost money: ReportFraud.ftc.gov. If money left your account, call the bank first.

Already clicked or paid? The Money Theft & Forensics page has the recovery steps.

Sources

• FTC: How to recognize and avoid phishing scams
• FBI IC3: Criminals use generative AI to facilitate financial fraud (Dec 2024)