Scam emails
If it's rushing you, slow down.
Phishing was the most reported crime type to the FBI in 2025. Here's what those emails look like, where to report them, and what to do if you already clicked.
The numbers
-
Phishing tops FBI complaint counts
191,561 2025
The FBI's Internet Crime Complaint Center got 191,561 phishing and spoofing complaints in 2025, more than any other crime type it lists. That's down from 193,407 in 2024 and 298,878 in 2023.
-
Reported phishing losses
$215,843,126 2025
People reported $215,843,126 in losses from phishing and spoofing to the IC3 in 2025, up from $70,013,036 in 2024.
Scam signs
Signs an email is phishing
- It says there's been suspicious activity or login attempts on your account.
- It claims there's a problem with your account or payment information.
- It says you need to confirm personal or financial information.
- It includes an invoice you don't recognize.
- It wants you to click a link to make a payment.
- It says you're eligible to register for a government refund.
- It offers a coupon for something at no cost that isn't real.
- It uses a generic greeting instead of your name.
- It says your account is on hold because of a billing problem and asks you to click a link to update your payment details.
- It uses urgent or emotional language, especially threats of serious consequences if you don't respond right away.
- It asks you to send personal and financial information.
- It uses shortened links you can't trust.
- The email address or link is slightly off, like amazan.com instead of amazon.com.
- The sender's name and email address don't match.
- When you hover over a link, the web address doesn't match what the link says.
- It asks you to enter a password after clicking a link in the message.
Sources: consumer.ftc.gov, cisa.gov, support.google.com. Some of CISA's consumer pages are now marked archived.
Worth knowing
-
Good grammar isn't proof anymore
CISA notes that bad grammar used to be a common tip-off, but with AI some phishing emails now have perfect spelling and grammar. Note: CISA labels this page as archived content.
Source: CISA Secure Our World, Recognize and Report Phishing (marked Archived Content)
-
Real companies don't send payment-update links
The FTC says legitimate companies won't email or text you a link to update your payment information.
Source: FTC Consumer Advice, How To Recognize and Avoid Phishing Scams (Sept 2022)
-
Check with the company yourself
If a message says it's from a company you do business with, contact that company using a phone number or website you know is real, not the info in the message.
Source: FTC Consumer Advice, How To Recognize and Avoid Phishing Scams (Sept 2022)
-
Gmail won't email you for your password
Google says Gmail won't ever ask for personal information like your password over email.
Where to report it
-
Forward phishing to APWG
The FTC says to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, and APWG's own site gives the same address.
Source: FTC Consumer Advice, How To Recognize and Avoid Phishing Scams (Sept 2022)
-
Report phishing to the FTC and texts to 7726
Report phishing attempts to the FTC at ReportFraud.ftc.gov. For a phishing text message, forward it to 7726 (SPAM).
Source: FTC Consumer Advice, How To Recognize and Avoid Phishing Scams (Sept 2022)
-
Gmail's Report phishing button
In Gmail on a computer, open the message, click More next to Reply, then click Report phishing.
If you already clicked
Do these, in order
- If you think a scammer has your Social Security, credit card, or bank account number, go to IdentityTheft.gov for steps based on what you gave away.
- If you clicked a link or opened an attachment that may have downloaded harmful software, update your security software, run a scan, and remove anything it flags.
- If you know your device was hacked or infected, take it offline right away, then remove the malware and report it to the FTC.
- If you can't get into your email, update and run your security software, then follow your email provider's account recovery steps.
- Once you're back in, change your password, sign out of all devices, and turn on two-factor authentication.
- Make sure the recovery email addresses and phone numbers on the account are ones you added and can still reach.
- Look for forwarding rules you didn't set up and delete them, so your mail isn't copied to someone else.
- Check your sent and deleted folders for messages the hacker sent or read.
- Tell your contacts about the hack, and ask them not to click links in emails from you or answer pleas for money.
- Report the phishing attempt to the FTC at ReportFraud.ftc.gov.
Sources: consumer.ftc.gov, page 1, consumer.ftc.gov, page 2, consumer.ftc.gov, page 3.