Join for $1
Scamwise › Top 10 scams › Phishing emails and texts
Scam #1 of 10 · Most common

Phishing emails and texts: how they work and how to spot them

Updated October 2026 · 4 minute read

Messages pretending to be your bank, Netflix, Amazon or a delivery company, pushing you to a fake login page that steals your password or card.

How the scam works

Like almost every scam, this one follows a three step script:

  1. The hook. Something believable lands in front of you: a message, a call, an ad or a new "friend".
  2. The pressure. Urgency, fear, excitement or secrecy, so you act before you think or talk to anyone.
  3. The payment. A method that can't be reversed: gift cards, crypto, a Bitcoin ATM, or an e-Transfer to a stranger.

Spot any one of those three steps and you can stop the whole thing.

Red flags to watch for

  • Urgent warning: account locked, payment failed
  • Link domain doesn't match the real company
  • Asks you to log in or confirm card details
  • Pressure to keep it secret or to act right now.
  • Any request for gift cards, crypto, a Bitcoin ATM or an e-Transfer to a person's name.

What to do if it happens to you

Never click. Open the app or type the real website yourself. If you entered a password, change it and turn on 2FA.

If you already paid or shared details

  1. Call your bank or card issuer right away and ask them to stop or reverse the payment.
  2. Change any password you entered, and turn on two step verification.
  3. Report it to the Canadian Anti-Fraud Centre (1-888-495-8501) in Canada, or reportfraud.ftc.gov in the US.
  4. File a police report and keep every message, receipt and screenshot.
  5. Watch out for "recovery" offers. Anyone promising to get your money back for a fee is running a second scam.

Related scams

  • Scareware pop-up: Fake virus alerts that push you to buy useless 'antivirus' software.
  • SIM swap: Scammers move your phone number to their SIM to intercept bank codes.
  • Verification code trick: 'I sent you a code by mistake, can you send it back?' It's your account.
  • QR code scam: Fake QR stickers on parking meters lead to payment stealing sites.
  • Malicious browser extension: Free extension that injects ads or steals passwords.
  • Fake app: Copycat banking or wallet app in an app store that harvests logins.

More scam guides

Get all 110 scams explained

Monthly scam alerts and printable family checklists. Just $1 a month.

Join Scamwise for $1