Glossary/Phishing

Glossary term

Phishing

Phishing is a scam that tricks you into trusting a fake message, site, or login so attackers can steal credentials, money, or personal information.

What it is

Phishing is one of the most common online scams. Attackers pretend to be a bank, delivery service, employer, government agency, or someone you know. The message looks urgent or helpful — verify your account, your package is held, reset your password — and points you to a page or action that benefits the scammer.

It can arrive by email, text, chat, social DM, or even a QR code (quishing). The shared goal is to get you to hand over passwords, one-time codes, payment details, or other sensitive data without realizing you have been deceived.

How it works

  1. Bait — You receive a message that looks official and creates urgency or curiosity.
  2. Hook — A link, attachment, QR code, or callback number leads you somewhere the attacker controls.
  3. Trap — A lookalike login, payment form, or support chat asks for credentials, codes, or card details.
  4. Payoff — Stolen access is used for account takeover, fraud, or sold; sometimes a follow-up call or text finishes the con.
  5. Spear phishing personalizes the bait with details about you; smishing and vishing are phishing by SMS and voice.

Red flags

  • Unexpected urgency: Act now or your account will be closed
  • Links or domains that do not quite match the real brand (extra words, misspellings, odd endings)
  • Requests for passwords, one-time codes, SSN, or seed phrases by email or chat
  • Attachments you did not ask for, especially invoices or secure documents from cold contacts
  • A message that creates fear or a too-good-to-be-true reward
  • Pressure to skip normal checks (Do not call the bank — use this link)

What to do if you’re targeted

  • **Pause before clicking or logging in.** Open the real site or app yourself from a bookmark or official store — do not reuse the message link.
  • **If you entered a password:** change it on the real site, turn on multifactor authentication, and review recent activity.
  • **If you shared payment info:** contact your bank or card issuer right away and watch statements.
  • **Report** the message to the brand or platform, and consider filing at ReportFraud.ftc.gov (U.S.).
  • **For a broader check-in:** run a free identity scan or start monitoring if you are worried your personal data may already be exposed elsewhere.

Related terms

Next steps

Free identity scan

Check for signs your information may be exposed — free and straightforward.

Free identity scan

Protect your identity

Dark web and social monitoring, plus identity theft insurance up to $1M (subject to policy terms).

Protect your identity