Phishing, Smishing and Vishing: Spot Them and What to Do If You Clicked

Phishing is a scam message that pretends to come from a company or agency you trust so you will hand over a password, account number, Social Security number or payment. It is called phishing when it arrives by email, smishing when it arrives by text message, and vishing when it arrives as a phone call or voicemail. The tell is almost always the same: an urgent problem (a suspicious login, an unpaid toll, a package that cannot be delivered) and a link, number or code request that lets you "fix" it.

If you already clicked or answered, what to do next depends on what you gave away. If you only clicked, the FTC's fix is a security scan. A password, a one-time code, a card number, bank login or Social Security number each has its own fix, and if a thief has already used your login or code to move money out of your account, federal rules treat that as an unauthorized transfer you can dispute with your bank. Call your bank or card issuer first, using the number on your card or statement, then work through the steps below.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers United States federal law and federal agency guidance on phishing, smishing and vishing: the federal criminal statutes on wire fraud, identity fraud and computer fraud, the FTC's Impersonation Rule, Regulation E's protections for unauthorized bank transfers, and the free federal credit-freeze right. It notes California's Anti-Phishing Act and anti-phishing statutes in Texas and Virginia. It does not survey every state's law, and it does not cover phishing aimed at businesses (such as business email compromise).

What is phishing, smishing and vishing?

All three are the same trick sent through a different channel. The scammer pretends to be someone you trust, such as your bank, a toll agency, the Postal Service, Amazon, the IRS or your boss, and pushes you to act before you think.

Phishing: The FTC describes it this way: "Scammers use email or text messages to try to steal your passwords, account numbers, or Social Security numbers. If they get that information, they could get access to your email, bank, or other accounts. Or they could sell your information to other scammers."

The Cybersecurity and Infrastructure Security Agency (CISA) defines smishing as "Phishing via text messages to get the victim to click on a link, download files and applications, or begin a conversation" and vishing as "Phishing via voice communication to entice the victim to engage in conversation and build trust." The FBI describes smishing as an attack using fake texts "to trick people into downloading malware, sharing sensitive information, or sending money to cybercriminals."

Vishing now includes cloned voices. In a May 15, 2025 public service announcement about a campaign impersonating senior US officials, the FBI's Internet Crime Complaint Center (IC3) warned that vishing "may incorporate AI-generated voices" and that criminals "are more frequently exploiting AI-generated audio to impersonate well-known, public figures or personal relations to increase the believability of their schemes." Our guide to AI voice scam calls covers that variant in detail.

How to spot a phishing email, text or call

The FTC lists the stories scammers tell most often. The message might say someone noticed suspicious activity or login attempts on your account, claim there's a problem with your account or payment information, ask you to confirm personal or financial details, include an invoice you don't recognize, or promise a government refund or a free coupon. None of those are real.

Three rules from federal agencies catch most of these messages:

1. Real companies don't ask for payment details by link. The FTC says "legitimate companies won't email or text with a link to update your payment information," and "Legitimate companies won't ask for information about your account by text."
2. Nobody legitimate asks for your verification code. The FTC says "Anyone who asks you for your account verification code is a scammer," and that no caller from your bank's fraud department "will ever ask for the verification code. That's always a scam."
3. Nobody legitimate tells you to move money to protect it. In the FTC's words: "Someone who says you have to move your money to protect it is a scammer. Period."

Do not rely on spelling mistakes. CISA's consumer guidance says poor grammar used to be a common sign, "although in the era of artificial intelligence (AI) some emails will now have perfect grammar and spelling, so look out for the other signs."

When you are unsure, the FTC suggests one question: "Do I have an account with the company or know the person who contacted me?" If the answer is yes, contact the company using a phone number or website you know is real, not the link, number or reply option in the message. CISA adds that you should not click any link in a suspicious message, including an "unsubscribe" link.

The scam texts and calls people report most

The FTC's analysis of 2024 text-scam reports found that five scripts made up about half of all text-scam reports: fake package-delivery problems (the most reported), phony job offers, fake fraud alerts, unpaid tolls, and "wrong number" texts that start a conversation.

Toll text scams (E-ZPass, SunPass, FasTrak, Peach Pass)

The unpaid-toll text is a smishing script that the FBI has tracked since 2024. On April 12, 2024, the IC3 issued an alert titled "Smishing Scam Regarding Debt for Road Toll Services," reporting that since early March 2024 it had "received over 2,000 complaints reporting smishing texts representing road toll collection service from at least three states." The FBI quoted a typical message: "(State Toll Service Name): We've noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit https://myturnpiketollservices.com to settle your balance."

The FBI explained that the link "is created to impersonate the state's toll service name, and phone numbers appear to change between states." Its advice: check your account on the toll service's legitimate website, call the toll service's real customer service number, and delete the text. If you clicked or entered information, the FBI says to "take efforts to secure your personal information and financial accounts" and "Dispute any unfamiliar charges."

The E-ZPass Group issued its own warning in an April 26, 2024 media advisory, stating that "The toll account information provided in these texts is neither valid nor accurate." It told customers to delete the texts without clicking, and said "Customers who have clicked the link and completed the form should immediately contact their financial institution and notify E-ZPass of any erroneous information posted to their accounts."

The wave did not stop. On March 12, 2025, the FBI's Atlanta field office reported that complaints about fake texts from Georgia's Peach Pass system had "jumped dramatically": 1,573 complaints in the first part of March 2025, compared with 1,720 over the 14 months from January 1, 2024 to February 28, 2025. In its April 2025 review of 2024 text scams, the FTC said these toll texts imitate programs "all over the country, from SunPass in Florida to FasTrak in San Francisco," and that "these scammers are really after credit card and even Social Security numbers."

USPS and package-delivery text scams

The FTC found that package-delivery messages, "usually from someone pretending to be from the U.S. Postal Service, were the most reported text scam" in 2024, and that "Many people reported paying a small 'redelivery fee' that turned out to be a trick to get their credit card or even Social Security number."

The U.S. Postal Inspection Service (USPIS) is direct about how real USPS texts work: "USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and it will NOT contain a link." If you already interacted with the link, USPIS says to notify your financial institution "even if you did not click 'submit'."

Fake bank fraud alerts and verification-code calls

This is the script that drains bank accounts. The FTC describes texts that "often look like they're from a bank or Amazon" and either give a number to call or ask you to reply YES or NO to verify a large transaction. "People who reply are connected to the (fake) fraud department," the FTC says, and the scammers then "pressure people into moving money out of their accounts to supposedly keep it safe, but it really goes to the scammers."

A related version asks for the one-time code your bank just texted you. The FTC warns: "If you give them the code, they can log into your account and transfer all the money out of your savings or investment accounts." If you get a call like this, hang up and call your real bank using "the number you find on your statement," as the FTC puts it, "never the number the caller gave you."

IRS and government look-alikes

The IRS says "We don't send text messages without your permission." Messages claiming to be from a government agency are also covered by the FTC rule against government impersonation, discussed below. For tax-related identity theft after a phishing attack, see our guide to tax identity theft.

I clicked on a phishing link: what to do now, by what you gave away

Work out what actually left your hands, then use the matching fix. If more than one applies, do all of them, starting with anything that touches money.

You clicked the link but didn't enter anything

The FTC's advice if you think you clicked a link or opened an attachment that downloaded harmful software: "update your computer's security software. Then run a scan and remove anything it identifies as a problem." Keep an eye on your accounts afterward. If the link was a fake USPS page, remember the Postal Inspection Service's warning that interacting with the page can matter even if you never pressed submit, so tell your bank if you typed anything at all.

You entered a password

The FTC says that if you gave a scammer the username and password to one of your accounts and you can still log in, "Create a new, strong password for the account that was compromised. (If you use the same password on another account, change it there, too.)" Then turn on two-factor authentication. The FTC explains that multi-factor authentication "makes it harder for scammers to log in to your accounts if they do get your username and password."

If the scammer has already changed your password and locked you out, use the account provider's official recovery process (the FTC's guide "How To Get Back Into Your Hacked Account" links to recovery pages for popular services).

You gave a one-time code (verification code)

A one-time code lets the scammer finish logging in as you. Call the company the code came from right away, using the number on your card, statement or the company's real website, and tell them the code was stolen. Change the account password and turn on stronger authentication. Then check the account for transfers, new payees and changed contact details.

If the code was for your bank and money has already moved, that matters legally: the CFPB treats a transfer made by a fake bank representative who tricked you into giving a "texted account confirmation code" as an unauthorized transfer (see the section below on money taken from your bank account).

You gave a credit card number

The FTC says to report it "to the credit card issuer immediately. Use the number on the back of your card or log in to your account online or through their app," and ask for a refund.

Federal credit card rules are strong here. Under Regulation Z, your liability for unauthorized use of a credit card "shall not exceed the lesser of $50 or the amount" obtained before you notify the issuer (12 C.F.R. § 1026.12(b)(1)(ii)), and the official commentary says unauthorized use includes a transaction initiated by someone who obtained the card "through fraud or robbery." To use the billing-error dispute process, your written notice must reach the issuer within 60 days after it sent the first statement showing the charge (12 C.F.R. § 1026.13(b)). Our guide to getting money back after a scam walks through both.

You gave a debit card number or your bank login

Call your bank or credit union's fraud line now, using the number on your card or statement, and tell them the card number or login was stolen in a scam. Ask them to block the card, reset your online banking credentials and check for transfers. The FTC says "Federal law protects you from unauthorized use of your debit card." If money has already left, report each transfer as unauthorized (next section).

You gave your Social Security number

The FTC's steps depend on whether the number has been used:

• If the scammer used it: "Go to IdentityTheft.gov to report it. Get a customized recovery plan based on your situation."
• If the scammer didn't use it or you aren't sure: "Go to IdentityTheft.gov/databreach" and follow the steps to protect yourself.

Then freeze your credit. A credit freeze stops new accounts from being opened in your name, and federal law makes it free: under 15 U.S.C. § 1681c-1(i), each credit bureau "shall, free of charge, place the security freeze" within 1 business day of a phone or online request (3 business days by mail). The FTC says "There's no cost to place or lift a credit freeze, and it doesn't affect your credit score," that "A credit freeze lasts until you lift it," and that you must contact all three bureaus: Equifax, Experian and TransUnion. A one-year initial fraud alert is a lighter option; you contact one bureau and it "must tell the other two." Our guide to credit freezes vs. fraud alerts compares them, and our guide on how to report identity theft covers the IdentityTheft.gov report. Spanish speakers can report at RobodeIdentidad.gov.

You installed something or let someone into your computer

If the message or caller got you to install an app or allow remote access, the FTC says to update your security software, "Run a scan and delete anything it identifies as a problem," and "Change your passwords and turn on two-factor authentication to protect your accounts." If you logged into your bank while the scammer was connected, call the bank: the CFPB lists a third party "using phishing or other methods to gain access to a consumer's computer and observe the consumer entering account login information" as a situation that produces unauthorized transfers. Our guide to tech support and fake invoice scams covers remote-access scams in depth.

Did the scam take money from your bank account?

It depends on who pressed send. If the thief moved the money using your login, card number or code, federal rules treat it as an unauthorized transfer, and your bank has to investigate. If you moved the money yourself because the scammer convinced you to, those protections are written for a different situation.

Regulation E, the federal rule for debit cards, ATM, online and app transfers out of consumer bank accounts, defines the term this way:

"'Unauthorized electronic fund transfer' means an electronic fund transfer from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit." (12 C.F.R. § 1005.2(m))

The Consumer Financial Protection Bureau has answered the phishing question directly in its official Regulation E FAQ. When "a consumer is fraudulently induced into sharing account access information with a third party, and a third party uses that information to make an EFT from the consumer's account, the transfer is an unauthorized EFT under Regulation E." The CFPB gives two examples:

"(1) a third-party calling the consumer and pretending to be a representative from the consumer's financial institution and then tricking the consumer into providing their account login information, texted account confirmation code, debit card number, or other information that could be used to initiate an EFT out of the consumer's account, and (2) a third party using phishing or other methods to gain access to a consumer's computer and observe the consumer entering account login information."

Two more points from the same FAQ help phishing victims. Your bank cannot raise your liability because you were careless: Regulation E's commentary "expressly states that negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E." And for payment-network transfers such as person-to-person payments, private network rules that call a transfer "final and irrevocable" do "not reduce consumer protections against liability for unauthorized EFTs." Our guide to Zelle and payment app scams covers those apps.

The clock: report fast

Speed protects you in two ways: the bank may be able to stop the money, and Regulation E's limits on your liability depend on when you report.

• Within two business days of learning that your card, code or other access device was lost or stolen, your liability is capped at "the lesser of $50 or the amount of unauthorized transfers that occur before notice" (12 C.F.R. § 1005.6(b)(1)). Later notice can raise the cap to $500 (§ 1005.6(b)(2)). These two tiers are written for a lost or stolen access device, and neither the regulation nor the CFPB's FAQ says whether a code or login you were tricked into sharing starts that two-day clock, so report within two business days of discovering the scam to be safe. If a transfer was made without an access device at all, the $50 and $500 tiers do not apply and only the 60-day rule below does (Official Interpretation, comment 6(b)(3)-2).
• Within 60 days after the bank sends the statement that first shows the unauthorized transfer, you must report it "to avoid liability for subsequent transfers" (§ 1005.6(b)(3)), and the bank's formal error-resolution duties apply to a notice received within that window (§ 1005.11(b)(1)(i)). The bank must extend these times to a reasonable period if your delay was due to "extenuating circumstances" (§ 1005.6(b)(4)).
• You can report by phone. The bank may ask for written confirmation within 10 business days of your call (§ 1005.11(b)(2)), and it must tell you so when you call.

Once you report, the bank generally has 10 business days to decide whether an error occurred. It may take up to 45 days (90 days for some transfers, such as point-of-sale debit card transactions) only if it provisionally credits your account within 10 business days (12 C.F.R. § 1005.11(c)). The full timeline, and what to do if the bank says no, is in our guide to getting money back after a scam.

If you sent the money yourself

In the fake-fraud-alert script the FTC describes, the scammer does not touch your account at all. A fake bank employee pressures you into moving the money yourself, supposedly to keep it safe. The Regulation E definition covers transfers "initiated by a person other than the consumer," so a payment you initiated yourself generally falls outside that definition as written, and banks and payment apps often treat such payments as authorized. The FTC is blunt: "If you are scammed into moving your money out of your account, you won't be protected. And you probably won't get that money back."

That does not mean you should not try. The FTC still tells people who paid a scammer by Zelle or bank transfer to "Report it to your bank or credit union immediately" and "Ask them to reverse the payment and refund your money." Any refund in that situation usually depends on the bank's or app's own policy rather than a legal requirement.

Where to report phishing, smishing and vishing

Reporting will not usually get your money back, but it helps carriers block numbers and helps law enforcement build cases. Report to your bank first if money or account access is involved, then to the channels that match the message.

For a fuller list by type of scam, see where to report a scam.

Is phishing illegal? The federal and state laws

Yes. Federal prosecutors reach phishing through several general criminal statutes, each covering a different stage of the scheme, and an FTC rule targets the impersonation itself. These are laws the government enforces. Reporting is how a victim sets them in motion.

Federal criminal law

• Wire fraud, 18 U.S.C. § 1343. The statute reaches anyone who, having devised a "scheme or artifice to defraud," transmits a wire, radio or television communication in interstate or foreign commerce "for the purpose of executing" it. A phishing email, text or call sent as part of such a scheme fits that description. The maximum is 20 years in prison; when the violation affects a financial institution, it rises to a fine of up to $1,000,000, up to 30 years in prison, or both.
• Identity fraud, 18 U.S.C. § 1028(a)(7). It is a federal crime to knowingly transfer, possess or use, "without lawful authority, a means of identification of another person" in connection with a federal crime or a state felony. That covers what phishers do with stolen Social Security numbers and account details.
• Aggravated identity theft, 18 U.S.C. § 1028A. Using another person's means of identification during certain listed felonies, which include wire fraud, adds a mandatory 2-year prison term "in addition to the punishment provided for such felony."
• Computer fraud, 18 U.S.C. § 1030(a)(4). Logging into your account with stolen credentials is a separate crime: knowingly and with intent to defraud accessing "a protected computer without authorization" to further the fraud and obtain anything of value.

The FTC Impersonation Rule

Since April 1, 2024, the FTC's Impersonation Rule (16 C.F.R. Part 461) makes it an unfair or deceptive practice to "materially and falsely pose as, directly or by implication," a government entity or officer (§ 461.2) or a business or business officer (§ 461.3). "Materially" means likely to affect a person's choice of, or conduct regarding, goods or services. A message falsely posing as a bank, toll agency, the Postal Service or the IRS is the kind of conduct the rule describes. The FTC enforces the rule, so a report to ReportFraud.ftc.gov is how a victim puts it to work.

CAN-SPAM and email headers

The federal CAN-SPAM Act makes it unlawful to send a commercial email that "contains, or is accompanied by, header information that is materially false or materially misleading" (15 U.S.C. § 7704(a)(1)). The Act defines an electronic mail message by reference to a mailbox and an Internet domain, so it is aimed at email rather than text messages. Robotext rules for phones are covered in our TCPA guide.

State anti-phishing laws

Some states have their own anti-phishing statutes. Three examples:

• California. The Anti-Phishing Act of 2005 (Cal. Bus. & Prof. Code §§ 22948 to 22948.3, effective January 1, 2006) makes it unlawful to use a web page, email or the Internet to induce someone to provide identifying information "by representing itself to be a business without the authority or approval of the business" (§ 22948.2). Identifying information includes a Social Security number, bank account number, card number, PIN and account password. California lets the victim sue: "An individual who is adversely affected" may sue the person who directly committed the violation for an injunction and "the greater of three times the amount of actual damages or five thousand dollars ($5,000) per violation" (§ 22948.3(a)(2)), and the court may award a prevailing plaintiff costs and reasonable attorney's fees. Adversely affected Internet access providers and web page or trademark owners can recover the greater of actual damages or $500,000 (for their suits, multiple violations arising from a single action or conduct count as one violation), and the Attorney General or a district attorney can seek civil penalties of up to $2,500 per violation.
• Texas. A 2005 law (House Bill 1098) created the Texas Anti-Phishing Act, originally enacted as Business and Commerce Code chapter 48 (we could not confirm its current chapter number on the official Texas statutes site), covering fake web pages and email fraud. As enacted, it let internet access providers, adversely affected web page or trademark owners, and the attorney general sue, not individual victims. We have not verified later amendments to the current text.
• Virginia. Va. Code § 18.2-152.5:1 makes it a Class 6 felony to use a computer to obtain identifying information "through the use of material artifice, trickery or deception," and a Class 5 felony to sell or distribute that information.

A lawsuit is only useful against someone you can identify, and a phishing victim often cannot identify the sender. For most victims, the bank or card dispute process described above is the practical route to getting money back.

Do phone carriers have to block scam texts?

Partly. Since May 11, 2023, an FCC rule (FCC 23-21) requires mobile wireless providers "to block--at the network level--texts purporting to be from North American Numbering Plan (NANP) numbers on a reasonable Do-Not-Originate (DNO) list," which covers invalid, unallocated or unused numbers and numbers whose owners say they never send texts. A scam text from a valid-looking number is not covered by that mandatory block, which is one reason forwarding scam texts to 7726 still matters.

How big is the problem?

• Text scams: "In 2024, people reported $470 million in losses to these scams, more than five times the 2020 number," according to the FTC's April 2025 data review. The FTC adds that because most frauds are never reported, the figure "likely reflects only a fraction of the actual harm." The share of text-scam reports involving a money loss rose from 5% in 2020 to 11% in 2024.
• How scammers reached people in 2025: Ranked by fraud reports with a loss, the FTC's April 2026 data showed website or app (31%), social media (28%), phone call (11%), email (10%) and text (7%). The FTC notes it did not collect reports during the 2025 government shutdown.
• FBI complaints: The IC3's 2024 annual report listed phishing and spoofing as the most-reported crime type, with 193,407 complaints and $70,013,036 in reported losses. Its 2025 report put phishing and spoofing losses at $215,843,126.

These counts are self-reported complaints, and the FTC and FBI figures come from different datasets, so they should not be added together.

Related guides

• Scams and fraud laws: the complete guide
• How to get your money back after a scam
• Where to report a scam
• Zelle and payment app scams
• Tech support and fake invoice scams
• Identity theft laws
• Phone scams targeting Spanish speakers
• How to Tell if Something Is a Scam

Last updated: October 2, 2026.

Disclaimer: This article provides general legal information about United States federal law and the state laws named above, verified as of October 2, 2026. It is not legal advice. For your specific situation, contact your bank, card issuer or payment company, the agency named above, or a lawyer licensed in your state.

Frequently Asked Questions

What is the difference between phishing, smishing and vishing?

They are the same scam through different channels: phishing usually means email, smishing means text messages, and vishing means phone calls or voicemail. CISA defines smishing as phishing via text messages and vishing as phishing via voice communication.

I clicked on a phishing link but didn't enter anything. Am I okay?

The FTC says to update your security software, run a scan and remove anything it flags. If it was a fake USPS page, the Postal Inspection Service says to tell your bank if you interacted with it even without pressing submit.

What should I do if I entered my password on a phishing site?

Change the password right away, change it anywhere else you used it, and turn on two-factor authentication, as the FTC advises. If you are locked out, use the provider's official account-recovery process.

Is the toll text I got a scam?

Very likely. The FBI warned on April 12, 2024 about texts claiming unpaid tolls with links that impersonate state toll services, and E-ZPass said the account information in those texts is neither valid nor accurate. Check your balance on the toll agency's real website instead of tapping the link.

Does USPS send texts about package delivery?

Only if you asked. The Postal Inspection Service says USPS will not text or email you without your first requesting it with a tracking number, and the message will not contain a link. Report fake ones to spam@uspis.gov and forward them to 7726.

Will my bank refund money a scammer took after I gave them a code?

If the scammer used the code or login to make the transfer, the CFPB says it is an unauthorized transfer under Regulation E, so the bank must investigate and limit your liability. Report it quickly and within 60 days after the statement that first shows it.

What if a fake bank employee talked me into sending the money myself?

Regulation E's definition covers transfers initiated by someone other than you, so a payment you sent yourself is generally treated as authorized, and the FTC warns you probably won't get it back. Still report it to your bank immediately and ask them to reverse it.

Where do I forward a phishing email or text?

Forward scam texts to 7726 (SPAM) and phishing emails to reportphishing@apwg.org, then report to the FTC at ReportFraud.ftc.gov. Fake IRS messages go to phishing@irs.gov.

Is phishing a crime?

Yes. Federal prosecutors can charge it as wire fraud under 18 U.S.C. 1343 (up to 20 years), identity fraud under 18 U.S.C. 1028, aggravated identity theft under 1028A, and computer fraud under 18 U.S.C. 1030. The FTC's Impersonation Rule also bans posing as a government agency or business.

Can I sue a phisher?

California's Anti-Phishing Act lets an adversely affected individual sue the person who directly violated it for three times actual damages or $5,000 per violation, whichever is greater. A lawsuit needs an identifiable defendant, so for most victims the bank or card dispute process is the practical route.