Learn About Reporting Phishing and Scam Emails

Understanding Phishing: What It Is and How It Works

Phishing is a type of scam where criminals send fake emails that look like they come from trusted organizations. The goal is to trick people into revealing personal information like passwords, credit card numbers, or Social Security numbers. The term "phishing" comes from the idea of casting a wide net to "catch" victims — just like fishing with bait.

Phishing emails often appear to come from banks, payment services like PayPal, social media platforms, or government agencies. The email might say your account has been compromised, you've won a prize, or you need to confirm your information. These messages create a sense of urgency to make you act without thinking carefully.

According to the FBI's Internet Crime Complaint Center, phishing was one of the most reported types of online fraud in recent years. In 2023, the Anti-Phishing Working Group reported blocking over 4.3 million phishing attacks. This shows how common these scams are and why learning to spot them matters.

The mechanics of phishing work in stages. First, the scammer researches a target or sends emails to thousands of people, hoping some will be customers of the organization they're impersonating. Next, the fake email contains a link or attachment that either steals information directly or takes you to a fake website designed to look real. Finally, when you enter your information on the fake site, criminals capture it and use it for identity theft, fraud, or selling it to other criminals.

Phishing attacks have become more sophisticated over time. Criminals use information from social media, data breaches, and other sources to make emails seem more personal and convincing. Some attacks target specific organizations or people — this more targeted version is called "spearphishing."

Practical Takeaway: Understand that phishing emails are designed to manipulate you emotionally. They create fake urgency or fear to bypass your normal caution. Recognizing this tactic is your first line of defense.

Common Signs of Phishing and Scam Emails

Phishing emails often contain red flags that can help you spot them before you fall victim. Learning to recognize these warning signs is one of the most useful skills for protecting yourself online. Many phishing emails share similar characteristics, even though criminals constantly change their tactics.

One of the most common signs is a suspicious sender email address. Scammers might use addresses that look similar to legitimate ones but have slight differences. For example, an email might come from "paypa1.com" instead of "paypal.com," using the number 1 instead of the letter l. Real companies use official domain names. Always check the complete email address, not just the display name.

Generic greetings are another red flag. Legitimate companies usually address you by your actual name since they have your account information. A phishing email might say "Dear Customer" or "Dear User" because the scammer doesn't know who they're targeting. Real banks and companies personalize their communication.

Phishing emails frequently contain links or buttons asking you to click through. When you hover over these links (without clicking), you can see where they actually lead. Legitimate companies rarely ask you to click links in emails to access important accounts. Instead, they recommend going directly to the official website by typing the address in your browser or using a bookmark.

Here are other common warning signs to watch for:

• Requests for passwords, Social Security numbers, credit card numbers, or PINs — companies never ask for this information via email
• Spelling and grammar errors — many phishing emails come from outside the country and may contain obvious mistakes
• Unusual attachments — especially .exe, .zip, or .scr files that could contain malware
• Threatening language or urgency — phrases like "act now," "verify immediately," or "your account will be closed"
• Strange formatting, odd colors, or poor quality logos — signs that the email was created hastily
• Requests to reply with personal information — legitimate companies use secure online portals, not email replies
• Too-good-to-be-true offers — free money, prizes you didn't enter, or unexpected refunds
• Mismatched sender information — the "from" address doesn't match the supposed company

It's important to understand that scammers are getting better at mimicking real emails. Some phishing attempts now include real logos, proper formatting, and fewer obvious errors. This is why you shouldn't rely on just one warning sign. Look for combinations of suspicious elements.

Practical Takeaway: When you receive an unexpected email requesting action or information, pause and check multiple factors: the sender's email address, whether you're addressed by name, whether it contains requests for sensitive data, and whether the tone feels urgent or threatening. If several factors seem off, it's probably a scam.

Reporting Phishing Emails to the Right Places

When you receive a phishing email, reporting it helps protect other people and provides information to law enforcement and security organizations. Different organizations handle different types of reports, so understanding where to send each type of complaint is important.

If a phishing email impersonates your bank or financial institution, report it directly to the bank. Most banks have a fraud department and provide an email address specifically for phishing reports, usually listed on their official website. When you report to your bank, they can monitor for fraudulent activity on your account and warn other customers.

If the email impersonates a payment service like PayPal, Venmo, or Square Cash, go to their official website and look for their phishing report option. PayPal, for example, asks you to forward suspicious emails to a specific address. Never reply to the suspicious email itself — instead, forward it to the official report address.

For emails impersonating federal government agencies, the FBI's Internet Crime Complaint Center (IC3) accepts reports at ic3.gov. The IC3 tracks trends in online fraud and shares information with law enforcement agencies. You can report phishing attempts, scams, and other internet crimes through their online complaint form.

If an email impersonates the IRS or relates to taxes, report it to the Treasury Inspector General for Tax Administration (TIGTA) at phishing@irs.gov. The IRS also maintains information about common tax scams on their official website. This is particularly important because tax-related phishing is extremely common, especially during tax season.

For emails impersonating social media platforms like Facebook, Instagram, or Twitter, use the reporting features built into those platforms. Most social media sites have abuse reporting tools accessible through your account settings.

Many email providers including Gmail, Outlook, and Yahoo have built-in reporting features. You can usually report phishing by clicking a button in the email or marking it as spam. These reports help the email provider improve their spam filters and protect all their users.

When reporting phishing emails, follow these guidelines:

• Do not click any links or download attachments from the phishing email
• Forward the complete email, including headers, to the reporting address (most email programs have a "forward as attachment" option)
• Include information about what the email claimed and what made you suspicious
• Save a copy of the email for your records
• Report to the organization being impersonated, not just to law enforcement
• If you clicked a link or provided information, also change your password and monitor your accounts

The Anti-Phishing Working Group (APWG) also accepts reports at reportphishing.org. This organization works with law enforcement, email providers, and security companies to combat phishing at a large scale. Reporting to APWG contributes to industry-wide efforts to shut down phishing infrastructure.

Practical Takeaway: Keep a reference list of reporting addresses for organizations you use regularly. When you spot a phishing email, report it to both the organization being impersonated and to relevant authorities like the IC3 or your email provider. This takes only a few minutes but helps protect many other people.

Protecting Your Accounts After a Phishing Attempt

If you've clicked a phishing link, opened an attachment, or entered information