Phishing is still the most common way criminals get into email, bank, and work accounts. The messages are getting harder to spot: AI tools now write clean, convincing emails, and cloned voices can sound like a family member or your boss. The tricks underneath haven’t changed, though. Learn the patterns and most scams fall apart.
Red flags in any message
- Urgency or threats. “Your account will be closed today,” “a warrant has been issued,” “pay now to avoid a fee.” Pressure is the point: it stops you from checking.
- Requests for codes or passwords. No legitimate company will ask you to read back a security code it just texted you.
- Unusual payment methods. Gift cards, cryptocurrency, wire transfers, or payment apps to a stranger.
- Sender addresses that are almost right. Look for extra letters, swapped characters, or a familiar name on an unfamiliar domain.
- Links that don’t match. On a computer, hover over a link to see where it really goes. On a phone, press and hold. If the address isn’t the company’s real site, don’t open it.
- Unexpected attachments, especially “invoices,” “shipping labels,” or “voicemail” files.
- Changed payment details. An email saying a vendor, landlord, or title company has “new bank instructions” is a classic business email compromise. Always confirm by phone using a number you already have.
Text message scams
Fake package-delivery notices, unpaid toll bills, and “suspicious activity” alerts from your bank are the most common scam texts. Don’t tap the link. Open the company’s official app or type its web address yourself instead.
Phone calls and voice cloning
If a caller says they are from your bank, the IRS, tech support, or a relative in trouble, hang up and call back using a number you already know is real. Families can agree on a private code word to confirm an emergency call is genuine.
What to do if you already clicked
- Stop. Don’t enter anything else into the page or reply to the message.
- If you typed a password, change it right away from a device you trust, sign out of other sessions, and turn on 2-step verification. If you use that password anywhere else, change it there too.
- If you entered card or bank details, call the number on the back of your card and ask them to block it.
- If you opened an attachment or installed something, disconnect the device from Wi-Fi and get help before using it for banking or work.
- If it was a work account, tell your IT team now. Minutes matter.
How to report it
- Forward scam texts to 7726 (SPAM), which most U.S. carriers use to block senders.
- Use the “Report phishing” option in Gmail, Outlook, or your email app.
- Report fraud to the FTC at ReportFraud.ftc.gov.
Not sure if a message is real?
That’s exactly what we’re here for. Cyber Vault USA classifies phishing and social engineering as P3 incidents: for Overwatch members and employees covered by QRF, a specialist responds within 2 hours to help you assess what’s real, what’s a scam, and what to do next. If you’ve already given out a password or the scam has turned into an active threat on your device, that’s a P2 incident with a 2-hour response. All support is delivered remotely.
Questions about coverage? Contact us.
This article is general information, not legal or financial advice. Cyber Vault USA is not an insurance company. Overwatch and QRF are service subscriptions providing cybersecurity assistance, IT support, and identity restoration services; we do not issue insurance policies, pay claims, reimburse financial losses, or indemnify members against damages. QRF is a reactive support service and does not include monitoring of any kind. Service levels are response commitments, not resolution guarantees. Cyber Vault USA is not law enforcement or a 911 service. If you are in immediate physical danger, call 911.