Scammers Using Increasingly Sophisticated Phishing Tactics to Reach Potential Victims

Some scammers hack accounts and gather personal details from victims to launch highly targeted attacks, a practice known as spear-phishing.​​

Red flags for phishing

A major red flag is a sense of urgency — pressure to provide information or pay before you can check the story. Not every scam starts with pressure, though; some begin with a friendly conversation.

Phishing attempts may also include:

• Offers of free products or services, supercheap travel deals, or a sweepstakes prize or other financial windfall​
• Vague or generic language, such as “payment issue,” to describe a problem with an account or purchase​ 
• Threats of dire consequences, such as legal action or an account being frozen 
• The names of real people or organizations​ 
• Requests that you click a link, open an attachment, or reply with personal or financial information to take advantage of an offer or to resolve a problem​​

How to protect yourself from this scam​

• Check the claim, not just the message. If a text or email says there’s a problem with an account, open the company’s app or use a website you already know is genuine. For a bank, you can call the number on the back of your card. Don’t use the link or phone number supplied in the message.
• Check the full sender address, not just the displayed name. An address that does not match the organization is a warning sign. But a familiar-looking address does not prove the message is genuine: scammers can disguise sender information or use a compromised account.​
• Use antivirus software and keep it up to date. Activate firewalls and other settings that block malicious files.​ 
• Use strong, unique passwords for all your online accounts to minimize damage if you are hacked. Change passwords immediately if you suspect a breach.​
• Turn on multifactor authentication for your accounts, especially email and banking. It adds a verification step beyond your password, making it harder for someone who steals that password to sign in. Never share a verification code in response to an unexpected call or message.
• Don’t provide your Social Security number, account numbers or other sensitive information in response to an unexpected call, text or email.
• Use your phone’s features, carrier’s tools or an outside service to block unwanted calls. Let unexpected calls go to voicemail when possible, and remember that caller ID can be faked.
• Verify unexpected links and attachments — even when they seem to come from someone you know. Their account may have been hacked. Check with the person through a separate call or conversation.  ​​​

More resources

• Already responded to a suspected phishing attempt? If you entered a password, change it immediately through the real app or website, and change it anywhere else you reused it. If you shared card or bank details or sent money, contact your financial institution or payment provider immediately and ask what can be blocked or reversed. If you disclosed your Social Security number, use the federal government’s identity-theft recovery site for a personalized recovery plan.
• Forward phishing emails to the Federal Trade Commission (FTC) at reportphishing@apwg.org and phishing text messages to the FTC at SPAM (7726), as well as to the business or organization the sender claims to represent. Many companies have dedicated email addresses to report phishing, which you can find online.​ 
• You can also report phishing attempts to the FBI’s Internet Crime Complaint Center at www.ic3.gov. 
• For support and guidance, the trained fraud specialists at the free AARP Fraud Watch Network Helpline, 877-908-3360, can share information about what to do next and how to avoid scams in the future. The AARP Fraud Watch Network also offers online group support sessions.