Phishing Scam: How It Works, Types, and How to Protect Yourself
Phishing is the most common online scam. Learn how phishing works, the main types (email, SMS, voice, spear phishing), and how to protect yourself.
Phishing Scam: How It Works, Types, and How to Protect Yourself
Phishing is a scam where an attacker impersonates a trusted organization to trick you into revealing a password, one-time code, or card details — usually by sending you to a fake login page. It's the most common type of online fraud, and it works because the messages look convincing.
For a quick red-flag checklist, see how to recognize a phishing message. This guide covers the broader picture: how phishing works, the main types, and how to protect yourself.
How a phishing scam works
- The lure: a message that looks like it's from your bank, a delivery service, a government agency, or an employer.
- The hook: a reason to click — an "account problem," a "failed payment," a "package waiting," a "security alert."
- The trap: a fake login page that captures what you type.
- The theft: the attacker uses your credentials or sells them.
The main types of phishing
- Email phishing — mass emails impersonating banks or brands. See phishing checker.
- Smishing (SMS phishing) — fake text messages. See scam text messages and Uber code text scam.
- Vishing (voice phishing) — phone calls impersonating support or officials. See scam calls.
- Spear phishing — targeted emails using your real name, job, or contacts to seem credible.
- Clone phishing — a copy of a real email you previously received, with the link swapped for a malicious one.
Common phishing targets
- Banks and payment apps — PayPal scam, Apple Pay scam
- Healthcare portals — MyChart phishing scam
- Retailers — Amazon scam
- Delivery and courier services — scam text messages
How to protect yourself
- Never click links in unexpected messages. Go to the website directly.
- Never share passwords or OTPs. No legitimate organization asks for them.
- Enable two-factor authentication on every account that supports it.
- Check links before clicking — hover or press-and-hold to preview the URL.
- Use a phishing checker when something feels off.
If you fell for it
- Change the compromised password immediately.
- Enable 2FA and check for unauthorized logins.
- If you shared card or bank details, freeze the card and call your bank.
- Get a personalized action plan and report to your country's authority — see country guides.
Related guides
Important
This article is for general informational purposes only and is not legal, financial, or professional advice. GoCheckAI is an independent platform and is not affiliated with any government agency. Always report crime to official authorities in your country.
High Risk of Recovery Scam
Scam victims are often targeted again by fake “recovery agents.”
- Anyone claiming “We can recover your money for a small upfront fee” is almost certainly a scammer.
- Recovery is never guaranteed. No legitimate service charges an upfront fee to retrieve stolen funds.
- Scammers buy victim lists — expect fake “hackers”, “officials”, and “lawyers” to contact you.