Phishing is the most-reported cybercrime in America. Here's how it works.

This isn't what you think it is

When most people hear "phishing," they imagine a poorly spelled email from a Nigerian prince. That image is dangerously outdated. Phishing in 2026 is a professional, AI-augmented industry with specialized roles: access brokers who sell compromised credentials, campaign operators who design attacks, and money mules who launder proceeds.

Phishing and spoofing drew 191,561 complaints to the FBI's Internet Crime Complaint Center in 2025 — more than double the next-largest category — with $216 million in reported losses. What has changed is less the volume than the quality: AI now produces grammatically perfect, contextually relevant, personalized messages at scale. If a specific message has you uncertain right now, you can run it through our free scam checker for an instant risk assessment.

The 8 types of phishing you'll actually encounter

"Phishing" is an umbrella term. The attack that hits you depends on the channel and the target. Here are the eight variants worth knowing, each with the tell that identifies which one you are looking at. Those tells name the attack. They do not settle it. The test that settles it comes after the list.

The channel changes, but the goal never does: get you to act quickly, on their link, before you think. Voice and QR variants in particular have surged because they sidestep the email filters people have learned to trust. Several of these — especially vishing and deepfake calls — now overlap with AI-powered scams. The same unsolicited-message playbook also kicks off task scams — the fake "easy online job" that arrives by text, WhatsApp, or Telegram out of nowhere. And the whole pattern inverts if you are the one selling: instead of a fake login page aimed at a buyer, the seller gets a forged payment confirmation and a reason to ship before the money lands, which is how the Wompi scam in Colombia works.

Why "look for typos" is dead advice

For two decades, the standard guidance was simple: spelling mistakes, broken grammar, and clumsy formatting gave scams away. Generative AI erased that overnight. Today the majority of phishing emails are written or refined by AI — the language is clean, the tone matches the brand, and the message can be tailored to you specifically.

Here's what AI actually changed about the attacker's playbook:

• ▸

  Flawless language — grammar and spelling are no longer reliable signals — a perfect email is now the norm, not a reassurance.

• ▸

  Personalisation at scale — AI scrapes your public LinkedIn, social posts, and company site to reference your real role, colleagues, and recent activity.

• ▸

  Polymorphic variants — every email is subtly unique, which defeats the pattern-matching that older spam filters relied on.

• ▸

  Conversational follow-up — AI chatbots can hold a convincing back-and-forth, so a reply doesn't prove a human — or a legitimate one — is on the other end.

The one test the message cannot pass

Look back at the eight tells above and notice what they have in common. Every one of them is a property of the message: the address behind the display name, the link in the text, the QR code, the changed bank details. The sender controls all of it. With AI writing the copy, cloning the branding and spoofing the number, they now control it well enough that a careful reader can be wrong.

There is one thing the sender does not control: the channel you use next.

A real bank, a real courier, a real tax office and a real employer all survive that without complaint. None of them needs you to stay inside the message they sent. The FTC puts the same point the other way round in its own guidance: honest businesses give you time to think and to check their story, and pressure to act immediately is itself one of the signs of a scam. A phishing campaign cannot survive it, because the whole operation depends on you acting inside the channel it controls, before you use one it does not.

That is why the verdict is not in the message. It is in what happens when you leave it. If the sender resists, if you are told to stay on the line, if you are handed a "direct number" to use instead of your own, if you are warned that checking will cost you the refund or lock the account or lose the delivery, the resistance is the answer. Nothing legitimate needs you to skip the check. The full version of this argument, and why the reaction is the one signal that cannot be faked, is in why scammers sound official and why they create urgency.

None of this means stop reading the message. The eight tells above still earn their place: they tell you what you are dealing with, and plenty of phishing is still careless enough to be caught on sight. The claim is narrower and it matters. Inspecting the message is no longer sufficient on its own to decide whether to act. Use the tells to recognise the attack, and use the route test to decide.

Source: FTC, How To Avoid a Scam.

You clicked a phishing link: what to do right now

Clicking happens — to careful people on bad days. What matters is the next few minutes. Work through these in order:

1. 1.

   Don't enter anything else — if a login or payment page opened, close it. Do not type credentials, codes, or card details into it.

2. 2.

   Disconnect if you downloaded a file — if the link triggered a download, disconnect that device from the internet to limit anything that may be running.

3. 3.

   Change passwords from a different device — start with email and banking. Use a phone or another computer you trust, not the possibly-compromised one.

4. 4.

   Turn on two-factor authentication — add 2FA to email and financial accounts so a stolen password alone isn't enough.

5. 5.

   Run a malware scan — use your device's built-in security tools or a reputable scanner before re-connecting.

6. 6.

   Alert your bank — if you entered card or account details, tell your bank immediately and ask them to watch for or block fraudulent activity.

If money already moved, or you shared sensitive personal details, speed matters even more — follow the full playbook in our scam recovery guide, and if your personal data may be exposed, see identity theft.

How to report a phishing email

Reporting takes a minute and helps providers and investigators shut down the campaign for everyone else. Send it to as many of these as apply:

• ▸

  Anti-Phishing Working Group — forward the email to reportphishing@apwg.org, which feeds an industry-wide database of active campaigns.

• ▸

  Your email provider — use the built-in "Report phishing" or "Report spam" button — it trains the filter and forwards to abuse teams.

• ▸

  Your country's authority — FTC (reportfraud.ftc.gov) in the US, Report Fraud in the UK, Scamwatch in Australia, and equivalents elsewhere.

• ▸

  The impersonated company — most banks and big brands have a phishing or abuse address (often abuse@ or security@) so they can warn other customers.

For a full country-by-country directory of where to report different kinds of fraud, see our reporting guide.