The short version
Most scam messages, whether they arrive by email, text, phone or social media, follow the same pattern: they pretend to come from someone you trust, they create a problem or a prize, they hurry you, and they steer you toward paying or handing over details in a particular way. Recognising that pattern matters more than memorising any particular scam. When something fits it, stop, and check through a route you already know rather than any link, number or contact in the message itself.
What phishing is
Phishing is the use of a message that appears to come from a trustworthy source to trick someone into revealing information, sending money or installing something harmful. CISA's guidance on social engineering describes the wider family of techniques: manipulating people, rather than breaking into systems directly, to gain access or information. Phishing by text message is sometimes called smishing, and by voice call, vishing, but the method is the same.
These messages work because they borrow trust. They use the names and logos of banks, delivery firms, government agencies, online shops and employers, and sometimes the name of someone you actually know whose account has been taken over. They are aimed at ordinary human reactions: worry, helpfulness, curiosity and the wish to sort things out quickly.
Four signs most scams share
The FTC's guidance on avoiding scams sets out four signs that recur across almost every kind of scam. Paraphrased:
- They pretend to be from an organisation you know, often a government agency, a well-known business, a utility, or a charity. Sometimes they claim to be a relative or friend.
- They say there is a problem or a prize. Your account will be closed, you owe money, a parcel is held, a family member is in trouble, or you have won something.
- They pressure you to act immediately. They want a decision before you have time to think or talk to anyone.
- They tell you to pay in a specific way, such as with gift cards, a money transfer, a cryptocurrency or a payment app, or to move money to keep it "safe".
None of these signs proves a message is a scam on its own; real organisations do sometimes contact you about problems. But two or three together, especially pressure combined with an unusual payment request, are a strong reason to stop and check. The FTC is explicit that a legitimate organisation will not insist you pay by gift card or tell you to keep the request secret.
The stories scammers tell
The FTC's phishing guidance gives typical examples of the stories phishing messages use. They may say they have noticed suspicious activity or log-in attempts, claim there is a problem with your account or payment information, ask you to confirm personal or financial details, include an invoice you do not recognise, ask you to click a link to make a payment, say you are eligible for a government refund, or offer a coupon for something free.
The NCSC's phishing guidance points to similar signs: messages that claim to come from authority figures, that set a deadline, that play on emotion, that offer something scarce, or that refer to current events. CISA's Secure Our World guidance adds practical tells, such as urgent or emotional language, requests for personal or financial information, unfamiliar or slightly misspelled sender addresses, and links whose real destination does not match the organisation they claim to come from.
Example
An invented text message reads: "Your parcel could not be delivered due to an unpaid fee of 1.45. Pay within 24 hours or it will be returned." It names no sender you can verify, sets a deadline and asks for a small payment by link. The small amount is the trick: it seems too minor to question, but the payment page collects full card details. Checking means going to the delivery firm's own app or website, typed in yourself, and looking up the parcel there.
Calls, caller ID and pop-ups
The same pattern turns up on the phone. The FCC explains that caller ID can be spoofed: a caller can deliberately falsify the number that appears on your screen, including to make it look like a local number or a known organisation. A familiar name on the display is therefore not proof of who is calling. The FCC's advice is to not answer calls from unknown numbers where you can avoid it, not to give personal information in response to an unexpected call, and if a caller claims to be from a company or agency, to hang up and call back on a number from an official source.
Tech support scams combine calls and screens. The FTC describes unexpected calls, and pop-up warnings that claim your computer has a virus or problem, both urging you to call a number or let someone connect to your computer remotely. Its guidance is that legitimate technology companies do not contact people this way to fix problems they could not know about, and that you should not call the number in a pop-up or give control of your computer to someone who contacted you out of the blue. The updates explainer covers fake update prompts, which work in a similar way.
How to check safely
CISA's social engineering guidance recommends verifying a request through a separate channel. In practice that means three habits:
- Use your own route. Open the organisation's app, type its address yourself, use a bookmark you saved, or call the number on your card, statement or the official website. Never use the link, number or reply address in the message you are checking.
- Slow down. Urgency is part of the scam. A real organisation will still be there in ten minutes.
- Ask someone. Scams rely on isolation. Telling a friend or family member what the message says often makes the problem obvious.
Technical defences help too. A password manager that refuses to fill in a password on an unfamiliar site is a useful warning, and phishing-resistant sign-in methods such as passkeys protect you even when a fake page fools you. Both are covered in the passwords explainer and the MFA explainer.
Reporting, and if you already replied
Reporting helps agencies spot trends and warn others. In the United States, the FTC accepts fraud reports at ReportFraud.ftc.gov, and its guidance notes that spam text messages can be forwarded to 7726 (which spells SPAM). In the United Kingdom, the NCSC runs a reporting service for suspicious emails, and suspicious texts can also be forwarded to 7726. Many email services also have a "report phishing" button. After reporting, delete the message.
If you have already clicked a link, entered details or paid, act quickly and without embarrassment; these schemes are designed by professionals to fool careful people.
- If you entered a password, change it on the real site, and anywhere else you used it, then turn on a second factor.
- If you gave card or bank details or sent money, contact your bank or card provider using the number on your card or statement.
- If you installed something or gave someone remote access, disconnect the device from the internet and seek reputable help before using it for anything sensitive.
- Report what happened through the routes above.