How to Spot a Phishing Scam Before It Costs You
Phishing is the most common way scammers steal personal and financial information, and it keeps working because it keeps getting better. The days of obvious misspellings and Nigerian prince emails are largely over. Today’s phishing attempts often look nearly identical to legitimate messages from banks, government agencies, retailers, and even credit unions.
Learning to spot the signs before you click or respond is one of the most valuable things you can do to protect your finances. Here’s what to look for.
What Is a Phishing Scam?
Phishing is when a scammer impersonates a trusted organization or person to trick you into handing over sensitive information, such as login credentials, Social Security numbers, account numbers, or one-time passcodes. The name comes from fishing: the scammer casts a message and waits for someone to bite.
Phishing arrives by email most commonly, but also by text message (called smishing), phone call (called vishing), and increasingly through social media messages and fake websites. The delivery method changes, but the goal is always the same: get you to act before you think.
Red Flag 1: Urgency and Pressure Tactics
Phishing messages are almost always designed to make you feel like something terrible will happen if you don’t act immediately. Your account will be closed. Your package won’t be delivered. A charge will go through. You’ve been flagged for suspicious activity.
Legitimate organizations, including banks and credit unions, do not pressure you to verify information immediately over email or text. If a message creates a sense of panic or insists you must act within hours, that urgency is the manipulation, not a real deadline.
When in doubt, close the message and contact the organization directly using the phone number on the back of your card or on their official website.
Red Flag 2: The Sender’s Email Address Doesn’t Match the Organization
Scammers can make the display name of an email look like it’s from your bank. The actual email address behind it is a different story. Before you respond to or click anything in a financial email, hover over or tap the sender’s name to reveal the full email address.
Watch for small variations that are easy to miss at a glance: familyfirst-secure.com instead of familyfirstny.com, or an address with extra characters or a different domain entirely. These subtle changes are intentional and designed to fool a quick scan.
Red Flag 3: Links That Go Somewhere Unexpected
Never click a link in a financial email without checking where it actually leads. On a desktop, hover your mouse over the link and look at the URL that appears in the bottom left of your browser. On a phone, press and hold the link to preview the destination before opening it.
Phishing links often use URLs that look plausible but route you to a fake site designed to capture your login information. If the URL doesn’t exactly match the organization’s known domain, don’t click it.
A safer habit is to skip the link entirely and type the website address directly into your browser, or navigate to it through your bookmarks.
Red Flag 4: Requests for Information a Legitimate Organization Already Has
Your bank already knows your account number. The IRS already has your Social Security number. A real customer service representative from Family First will never call, text, or email you and ask for your online banking password, PIN, or one-time passcode.
If a message asks you to confirm information the organization should already have on file, that’s a significant warning sign. Scammers need you to provide the information because they don’t have it. Legitimate organizations asking you to verify your identity will do so in a controlled, secure environment, not through a link in an unsolicited email.
Family First will never ask you to provide your password, PIN, or one-time passcode by phone, email, or text. No exceptions. If anyone contacts you claiming to be from Family First and asks for this information, hang up and call us directly at 585.586.8225.
Red Flag 5: Generic Greetings and Vague Details
Legitimate messages from your financial institution will usually address you by name and reference specific account details. Phishing messages are often sent in bulk and use generic greetings like Dear Customer, Dear Member, or Dear Account Holder.
Similarly, phishing messages tend to be vague about which account or which transaction they’re referencing. A real fraud alert from your bank will typically include partial account information. A phishing attempt will keep things general so the message can be sent to as many people as possible.
What to Do If You Suspect a Phishing Attempt
Do not click any links, download any attachments, or respond to the message.
If the message appears to be from Family First, forward it to us or call 585.586.8225 so our team can investigate. You can also report phishing emails to the Anti-Phishing Working Group at [email protected], and report text message phishing by forwarding the text to 7726 (SPAM).
If you clicked a link or entered any information before realizing it was a phishing attempt, act quickly. Change your passwords immediately, contact your financial institution, and monitor your accounts closely for unauthorized activity. Visit home.familyfirstny.com/cybersecurity-and-fraud for a full list of fraud resources and reporting contacts.
Stay One Step Ahead With Account Alerts and Credit Monitoring
The best defense against phishing is awareness, but the best safety net is monitoring. Setting up real-time account alerts through Family First online banking means that even if a scammer does gain access to your account, you’ll know about it the moment something moves.
Family First members also have access to a free credit monitoring tool inside online banking. Keeping an eye on your credit score and report is one of the most effective ways to catch identity theft early, before a small breach becomes a larger financial problem.
For more resources on protecting yourself from phishing and other cyber threats, visit home.familyfirstny.com/cybersecurity-and-fraud. Our Rochester area branches are also available to help you review account security settings and answer any questions about keeping your information safe.
