How to Spot a Phishing Scam in 2026

Phishing is a scam message designed to look like it came from a bank, shipper, tech company, government agency, or someone you know. The goal is almost always the same: get you to click a link, open an attachment, or hand over a password, one-time code, or account number.

This guide explains how to spot phishing in email, SMS, and voice calls in 2026, what URL tricks to watch for, what to do if you already clicked, and how to report it. It follows Federal Trade Commission (FTC) and Cybersecurity and Infrastructure Security Agency (CISA) consumer guidance. It is general education, not personalized legal or security advice.

What is phishing?

The FTC’s phishing guidance describes phishing as scammers using email or text messages to trick you into giving personal or financial information. CISA adds that phishing is a form of social engineering: attackers pose as a trustworthy organization and solicit passwords or account details, often by claiming there is a problem with your account.

Related variants use the same idea on other channels:

• Smishing uses SMS or messaging apps.
• Vishing uses phone calls or voice messages, sometimes with spoofed caller ID.

Scale matters because phishing is not rare noise. In its 2024 Internet Crime Report, the FBI Internet Crime Complaint Center (IC3) recorded 859,532 total complaints and about $16.6 billion in reported losses across internet crime. Phishing/spoofing alone accounted for 193,407 complaints, more than any other crime type by volume, with about $70 million in reported losses tied to those complaints. IC3 notes that reported dollar figures often understate total harm.

For U.S. cyber and technology developments as they break, the U.S. News Live center is a useful follow-along hub. Pair breaking coverage with the spotting habits below so a headline does not become a click you later regret.

Common red flags in phishing messages

Scammers update stories to match the news, tax season, shipping peaks, or popular apps. The FTC says the packaging changes, but several tactics stay familiar. A suspicious message may:

• Claim unexpected suspicious activity or log-in attempts on your account
• Say there is a problem with your account or payment information
• Ask you to confirm personal or financial details
• Include an invoice you do not recognize
• Push a link to make a payment or “unlock” a package
• Promise a government refund you did not request
• Offer a coupon or free gift that requires a click or download

CISA’s Recognize and Report Phishing tips highlight similar warning signs: urgent or emotionally charged language, requests for personal or financial information, untrusted shortened URLs, and incorrect email addresses or lookalike domains (for example, a misspelled brand name). Perfect grammar is no longer a free pass. CISA notes that AI-assisted writing can make phishing emails look polished, so treat urgency and link quality as higher-signal clues than spelling alone.

Other classic tells from CISA’s older phishing guidance still help: a generic greeting such as “Dear Valued Customer,” a signature block with no real contact path, mismatched hover text on links, and unsolicited attachments. Legitimate companies may email you, but the FTC is clear that they will not unexpectedly email or text a link that asks you to update payment information.

Email, SMS, and voice: how the bait differs

Email phishing

Email remains a top contact method for scammers. Messages often spoof a bank, cloud storage provider, payroll portal, or package carrier. Look past the logo in the header. Check the full From address, not only the display name. Hover (on a computer) or long-press (on many phones) before tapping any link. If the visible text says your bank’s domain but the real URL points elsewhere, treat it as fake.

Attachments are another path. An unexpected PDF, invoice, or “secure document” can deliver malware. When in doubt, open nothing from the message. Use a bookmark or app you already trust to check the account yourself.

Smishing (text messages)

Smishing often pretends to be a delivery notice, toll bill, bank alert, or password reset. Texts are short, so scammers lean hard on urgency: “Your package is held,” “Your account will close today,” or “Reply YES to confirm.” Links may use URL shorteners that hide the real destination. CISA advises resisting the click, reporting the message, then deleting it. Do not use an “unsubscribe” link inside a suspicious text; that can confirm your number is active.

Vishing (voice and callback scams)

Vishing uses calls or voicemails that claim to be from tech support, your bank’s fraud desk, or a government office. Caller ID can be spoofed, so a familiar name on the screen is not proof. Hang up. Call back only through a number printed on your card, statement, or the organization’s official site. Never install remote-access software because a stranger on the phone asked you to.

URL tricks that hide a fake site

Even careful readers get fooled by lookalike addresses. Watch for:

• Homoglyph or misspelled domains (extra letters, swapped characters, or a brand name with a wrong top-level domain)
• Subdomain tricks that put a trusted name on the left while the real site sits elsewhere (the true site is usually the part just before the final domain)
• Shortened links that conceal the destination until after you tap
• HTTP instead of HTTPS on pages that ask for passwords or payment details (HTTPS is not a guarantee of honesty, but a missing lock on a login page is a warning)

CISA recommends verifying a company through a site or phone number you already know, not through contact details inside the suspicious message. Type the address yourself or use a saved bookmark. If a friend’s account seems to send a strange link, confirm through a separate channel before clicking.

How to protect yourself day to day

The FTC lists four practical layers that still apply in 2026:

1. Keep security software on computers updated automatically.
2. Keep phone software updated so you receive security patches.
3. Turn on multi-factor authentication (MFA) wherever important accounts offer it, so a stolen password alone is not enough.
4. Back up important data on a computer and phone so a malware payload is less catastrophic.

Add a few habits that cost almost nothing: use unique passwords (ideally with a password manager), mark junk as spam so filters learn, and treat unexpected payment or account-update links as hostile until proven otherwise through a known channel.

Phishing is also a common entry path for ransomware. If you want the next layer of defense after you stop the click, see LiveNewsWorld’s guide on what ransomware is and how to protect your devices.

What to do if you clicked or shared information

Act quickly, then report. The FTC’s sequence is straightforward:

• If you shared a Social Security, credit card, or bank account number, go to IdentityTheft.gov for steps matched to what was exposed.
• If you opened a link or attachment that may have installed malware, update your security software, run a full scan, and remove anything it flags.
• Change passwords for the affected accounts from a device you trust, starting with email, then banking and shopping logins. Turn on MFA if it was off.
• Watch statements for charges you did not make. Contact the bank or card issuer through numbers you already have.

If the message was only suspicious and you did not engage, still report it, then delete it. Do not forward the original lure to friends as a curiosity click.

How to report phishing

Reporting helps investigators and filters more than deleting alone. Practical channels:

• FTC: file at ReportFraud.ftc.gov
• Email: forward the message to the Anti-Phishing Working Group at reportphishing@apwg.org
• Text: forward the suspicious SMS to 7726 (SPAM)
• FBI IC3: for internet-facilitated crime complaints, use ic3.gov when money was lost or accounts were taken over

CISA’s consumer tip sheet frames the same idea as three words: recognize, resist, delete. Use the report tools in your email or messaging app when they are available, then remove the bait.

A quick spotting checklist

The bottom line

Phishing works when a message feels familiar and urgent enough to skip a second look. Slow that moment down. Check the sender, distrust unexpected payment or account links, verify through a channel you already trust, and report what you catch. The FTC and CISA playbooks have not changed in spirit even as scammers adopt better design and AI-written copy: recognize the bait, resist the click, then delete and report.

For live national video newscasts while you dig into explainers, the Watch Live News hub gathers major U.S. channels in one place. Stay informed without treating every alert in your inbox as an emergency.

Sources

• Federal Trade Commission, How To Recognize and Avoid Phishing Scams
• Federal Trade Commission, reporting portal ReportFraud.ftc.gov; recovery steps at IdentityTheft.gov
• Cybersecurity and Infrastructure Security Agency, Recognize and Report Phishing
• Cybersecurity and Infrastructure Security Agency, Avoiding Social Engineering and Phishing Attacks
• Federal Bureau of Investigation, Internet Crime Complaint Center, 2024 Internet Crime Report (PDF)