How to Recognize Phishing in Emails and SMS: A Practical Guide for Residents of the USA

Most of us receive such messages weekly: "Your package is waiting for a payment", "Unpaid toll", "Suspicious login to your account, please confirm your details". Some are clumsy, while others look legitimate. This guide teaches you to recognize both, step by step, with examples from American daily life, and explains what to do if you've already clicked.

An overview of current phishing campaigns impersonating the IRS, USCIS, and banks can be found in the guide Phishing 2026: fake IRS, USCIS, bank. Here, we focus on the skill of recognition and reporting.

Scope of the Problem

In the FBI Internet Crime Complaint Center (IC3) report for 2025, the category "phishing/spoofing" had 191,561 complaints, the highest of all crime types. Individuals over 60 submitted 48,064 such complaints. Direct losses attributed to phishing amounted to approximately $216 million, but this is only part of the picture: stolen passwords or card details are usually the first step to other frauds, which are categorized differently in statistics.

How the FBI Defines Phishing

IC3 describes phishing as unsolicited emails, SMS, and phone calls allegedly from a legitimate company, in which someone requests personal, financial, or login information. In practice, you will encounter three targets:

• Credential theft. A link leads to a copy of the bank or email website. The entered password goes to the scammer.
• Money theft. The "payment" page for a package or toll collects card numbers.
• Malware installation. An attachment or link installs software that steals data.

Warning Signs in Emails

The FTC and the cybersecurity agency CISA list similar signals. We have compiled them in the order in which they are best checked:

1. Did you expect this? The message is unexpected and looks like it is from a known company: bank, utility provider, card issuer, payment app.
2. Is there pressure? Urgent tone, threat of account blocking, "last warning", 24-hour deadline.
3. What do they want? Confirmation of personal or financial data, clicking on a "payment update" link, opening an invoice you don't recognize. The FTC notes that legitimate companies do not send links for payment data updates via email or SMS.
4. Who really sent it? Expand the full sender address. The display name may read "Bank Support", while the address ends with a completely different domain.
5. Where does the link lead? CISA warns against shortened addresses and addresses with minor letter changes. On a computer, hover over the link (without clicking), on a phone, press and hold it to see the address.
6. Is there a strange attachment? An invoice in a ZIP file, a document that "requires macros to be enabled", an HTML file.
7. Does it promise something for free? A government refund, free coupons, a prize. The FTC lists this as a typical signal.

How to Read a Website Address

Most scams can be recognized by the address in the link. Here are a few practical rules:

• The last two segments of the name before the first single slash “/” matter. In the address https://irs.gov.refund-check.com/login, the owner of the site is refund-check.com, and "irs.gov" at the beginning is just a disguise.
• Federal agency websites in the USA end with .gov. A .com or .net domain pretending to be IRS, USPS, or Social Security is a red flag.
• Watch out for swapped letters: "rn" instead of "m", the digit "1" instead of "l", additional words like "-secure", "-verify", "-support".
• A padlock and "https" only indicate an encrypted connection. Scammers also have sites with a padlock. This is not proof that the site is legitimate.
• The safest option is not to use the link at all: type the company's address yourself or use its official app.

Smishing: Fake SMS in the USA

SMS is short, so the scammer has less room for mistakes, and you have fewer clues. Therefore, the principle "I don't click, I check myself" is even more important here. The FTC states that legitimate companies do not ask for account details via SMS. The most common topics include:

Increasingly, instead of a link, there is a QR code, in a letter, flyer, or email. In July 2026, IRS Criminal Investigation warned about fake letters with a QR code leading to a counterfeit IRS site. The advice is simple: do not scan QR codes from unsolicited letters, emails, and SMS.

I Received a Suspicious Message: What Next

A flowchart will help decide what to do depending on how far the situation has progressed.

Where to Report Phishing

CISA also has an incident reporting form, but it is mainly intended for organizations. Individuals are best off reporting phishing to the FTC, APWG, via 7726, and to IC3.

How to Protect Yourself in the Future

• Multi-factor authentication (MFA). The FTC explains that a second factor, such as a one-time code, security key, or fingerprint, protects your account even if a scammer obtains your password.
• Automatic updates for your phone, computer, and security software.
• Backups on an external drive or in the cloud.
• Password manager and a different password for each account. CISA recommends a password manager as a simple way to protect yourself. See the guide Passwords, password managers, 2FA, and passkeys.
• Bookmarks instead of links. Save the addresses of your bank, IRS, USPS, and payment provider in your browser and only access them through those.
• Bank notifications in the app. When you know what a real notification looks like, it’s easier to distinguish a fake.

Myths and Facts

Frequently Asked Questions

Is just opening an email dangerous?

Usually, just reading it does not harm. The risk arises when clicking a link, opening an attachment, or replying. If the message raises doubts, report it and delete it.

The message looks real and concerns my bank. How can I check?

Do not use links or numbers from the message. Log in through the official app or manually typed address or call the number on your card. If the bank knows nothing about the issue, the message was fake.

I replied to the SMS with "YES" or "NO". What now?

Do not reply further and do not talk to anyone who calls "from the bank" now. The FTC advises not to respond to unexpected SMS and to contact the bank only through a number you know. Forward the SMS to 7726 and report it at ReportFraud.ftc.gov.

I provided information, but nothing bad happened. Do I need to do anything?

Yes. Change passwords, enable MFA, check statements, and consider freezing credit reports. Data can be used weeks later. See how to freeze a credit report and what to do with a compromised account.

Sources

As of October 23, 2026. This guide is for informational purposes only and does not constitute legal advice. Addresses and numbers for reporting may change, so check them on the FTC and FBI IC3 websites.