Home › Scams & Phishing: How to Spot Them
Scams and phishing: how to spot them and what to do
Phishing is when a scammer sends a text, email or call pretending to be a company you trust, like your bank, a utility, Amazon or the Postal Service, to get your passwords, account numbers or Social Security number. These messages can look very real. Here's how to tell, and what to do.
The one question to ask: Do I actually have an account with this company, or know this person? If not, it's very likely a scam. If you do, don't use the link or phone number in the message. Call the number on your card or statement, or type the company's website yourself.
Signs a message is a scam
- It says there's suspicious activity or a log-in attempt on your account.
- It says there's a problem with your account or your payment information.
- It asks you to confirm personal or financial information.
- It includes a bill or invoice you don't recognize.
- It wants you to click a link to make a payment, or says you're owed a government refund.
- It offers a prize, gift card or coupon for something free.
- It starts with a general greeting like "Dear customer" instead of your name.
Real companies may email or text you, but they won't send a link asking you to update your payment information. Even opening a link in an unexpected message can expose you to scammers.
Fake Postal Service texts
A common one says a package can't be delivered and asks you to click a link. The Postal Inspection Service says the Postal Service only texts or emails about a package if you asked it to track that package with a tracking number, and those messages never contain a link. If you're expecting a package, go to usps.com yourself to track it. You can report a fake USPS text by email to spam@uspis.gov: paste in the message (without clicking the link) and attach a screenshot.
Four ways to protect yourself
- Computer: use security software, and let it update itself automatically.
- Phone: turn on automatic software updates.
- Accounts: turn on two-step sign-in (also called multi-factor authentication), where you also enter a code sent to your phone. A scammer with your password still can't get in.
- Photos and files: back them up to an external drive or the cloud.
Your phone and your phone company can also filter or block unwanted texts. If setting any of this up sounds like a chore, the folks on my Tech help page do exactly this kind of thing.
If you already clicked or answered
- If you clicked a link or gave card or bank details, call your bank or card company using the number on your card.
- If you gave out your Social Security, card or bank account number, go to IdentityTheft.gov for a recovery plan.
- If you clicked a link on your computer, update your security software and run a scan.
- Please don't feel embarrassed. These scams fool careful people every day.
Where to report it
- Scam text: forward it to 7726 (the letters SPAM), or use the "report junk" option in your messages app.
- Scam email: forward it to reportphishing@apwg.org.
- Any scam: tell the Federal Trade Commission at ReportFraud.ftc.gov.
- If someone is taking advantage of an older or vulnerable adult, Arizona Adult Protective Services answers 24 hours a day at 1-877-767-2385.
For door-knockers, fake repair offers and "free" medical alert calls, see the scams list in my hiring guide.
Sources: Federal Trade Commission, How to Recognize and Avoid Phishing Scams, How to Recognize and Report Spam Text Messages and Don't take the bait on phishing scams; U.S. Postal Inspection Service, Smishing: Package Tracking Text Scams. Read November 3, 2026.