How to Spot Phishing, Smishing and Social-Engineering Scams

Last updated July 6, 2026

Most successful attacks start with a person being tricked, not a computer being hacked. Verizon’s breach research puts the human element in roughly two-thirds of breaches, and phishing remains the most-reported cybercrime to the FBI year after year. The good news: a few habits defeat almost all of it.

The one rule that beats most scams

Never act on contact you didn’t initiate. If “your bank,” “Microsoft,” “the tax office” or “your grandchild in trouble” reaches out to you — by email, text or phone — and asks you to click, pay, install something or share a code, stop. Look up the organisation’s real number or website yourself and contact them through that. Legitimate organisations survive this check; scammers don’t.

Red flags in emails and texts

Urgency and fear — “your account will be closed in 24 hours,” “a warrant has been issued.” Manufactured pressure is the core of every scam script.
Requests for codes — no legitimate company ever asks you to read back a 2FA or verification code. That code is someone logging into your account right now.
Mismatched links — hover (or long-press on mobile) before tapping. paypa1-secure.com is not PayPal.
Unexpected attachments — especially invoices, “shared documents” and voicemail notifications you weren’t expecting.
Payment by gift card, wire transfer or crypto — no government agency or real business is paid in gift cards. Ever.

Scams to know by name

Smishing: scam texts — fake delivery fees, unpaid tolls, “is this you in this photo?” links. Delete and report (forward to 7726 in the US/UK).
Vishing: fraud calls, increasingly with AI-cloned voices of relatives. Agree on a family code word for real emergencies.
Pig butchering: a “wrong number” text becomes a friendship, then an investment opportunity. Investment fraud is now the single biggest loss category in FBI IC3 data — over $6.5 billion in 2024.
Tech-support pop-ups: a browser page that locks fullscreen and tells you to call a number. Close the browser (force-quit if needed); nothing is actually wrong with your computer.

If you clicked or paid

Change the affected password immediately, and anywhere it was reused.
If money moved, call your bank’s fraud line now — speed matters for recalls.
Report it: ic3.gov (US), Action Fraud (UK), or your national equivalent.
Watch statements for a few months — see protecting your identity and finances.