Phishing
A fake email that pretends to be from a company or person that you trust, in order to persuade you to reveal personal information, such as passwords and credit card numbers.
Social Engineering
What is social engineering?
The fraudulent practice of sending messages claiming to be from reputable companies in order to persuade individuals to reveal personal information, such as passwords and credit card numbers.
Smishing
A text message that pretends to be from a company or person that you trust, in order to persuade you to reveal personal information, such as passwords and credit card numbers.
Vishing
A fake phone call or voicemail that pretends to be from a company or person that you trust, in order to persuade you to reveal personal information, such as passwords and credit card numbers.
Examples by scam type
See what each type of scam can look like
Open a section below to see common tactics and an example.
PhishingEmail scams
Common Phishing Red Flags
Generic greeting: “Dear customer” instead of addressing you by your name or username.
Email includes an invoice you don’t recognize: Scammers bank on busy or distracted individuals paying before checking records.
Email spoofing: A scammer disguises themselves as someone you trust, such as a boss, a company you have done business with, or a family member.
SmishingText message scams
Common Smishing Tactics
Banking scams: Claims they’ve detected unusual activity on your account and asks you to click the link to verify your transactions.
Package delivery scams: Claims they’ve failed to deliver a package and sends a link to schedule your redelivery.
Account verification scams: Claims they’ve detected a login attempt from an unfamiliar location and send you a link where you can “secure your account.”
Contest winner scams: Claims you’ve won a large prize and sends you a link to click on to “receive your reward.”
Emergency scams: Claims a family member has been arrested, had a medical emergency, or is in immediate danger and tells you to call a specific phone number for details.
VishingPhone call and voicemail scams
Common Vishing Tactics
Loan and investment scams: An individual calls you about an investment opportunity offering high returns with little risk, or loans that claim to pay off debt unusually quickly.
Delivery scams: A scammer impersonates a delivery service and provides a number to contact regarding alleged shipping issues.
Banking scams: Claims they’ve detected unusual activity on your account. Legitimate financial institutions will NEVER call to ask for passwords or security codes.
IRS tax scams: A prerecorded voice message alerts you to a problem with your tax return and may threaten that failure to respond could lead to a warrant for your arrest.
Social Security or Medicare scams: A scammer acts as if they work for the Social Security Administration or Medicare and asks for sensitive information.
Tech support scams: A scammer poses as a tech support representative and may ask for remote access to your computer or send malware-infected downloads.
Multi-step scams: Many scammers start a vishing attack with a phishing email and prompt the recipient to make a phone call instead of putting links in the email.
Preventing vishing attacks
Steps from the presentation
- 1
NEVER share sensitive data via email, text, or phone call. Legitimate organizations will not ask for sensitive information through any of these methods.
- 2
Do NOT respond to voice prompts from an unsolicited caller. Scammers use these tricks to confirm they’ve reached a real and compliant person.
- 3
Avoid answering calls from unrecognized numbers. Let the call go to voicemail, then listen to the message.
- 4
Register with a Do Not Call list. These lists can significantly reduce the number of unsolicited calls you receive from legitimate companies.
Be mindful that Caller IDs and phone numbers can be manipulated.
Common Red Flags
Warning signs that apply across email, text, and phone scams
What red flags do you notice?
- Asking to confirm personal or financial information.
- Urgent requests demanding immediate action.
- Asking you to make a payment by suspicious means, including retail gift cards or cryptocurrency.
- Claiming suspicious activity or log-in attempts.
- Aggressive coercion tactics, such as “Act now or your account will be closed.”
- Informal or casual language.
- Misspellings or typos.
- Offering free things, including gift cards, coupons, electronics, government grants, cash giveaways, or in-home services.
- Knowing personal information that may be publicly available.
- Odd sender information.
Odd sender information
Be cautious even when the sender looks familiar.
The email may not align with the company or person the scammer is attempting to impersonate. Be suspicious of email addresses from free email services such as Gmail or Yahoo claiming to be from major companies.
Senders may use personal mobile numbers claiming to be from legitimate organizations. Many automated messages, like shipping updates or bank alerts, come from five or six-digit numbers.
Scammers might use numbers that closely resemble those of a legitimate institution, so always be cautious, even when the caller ID shows a local number or company name you recognize.
Potential Scenario
What red flags do you notice? How might you respond?
Use the red flags above when reviewing an email, text message, or phone call that seems suspicious.
Deep Fakes and Impersonation
What are deep fakes?
Deep fakes are AI-generated images, videos, or audio that realistically depict people saying or doing things they never did.
Deep fake phishing
What it is
Scammers use AI technology and available audio, video, or images to impersonate people you may know.
The goal
To convince the recipient to take an action
Such as transferring funds, revealing sensitive information, or approving access.
Examples
Deep fake phishing examples
Audio messages
Someone calls you, sounding exactly like one of your family members, and asks for money urgently.
Video calls
Someone emails you asking to set up a meeting, which is then followed up by a real-time AI voice clone or video deepfake call.
Example fake family emergency callIllustration
Incoming callVoice clone example
▶0:18
“Hi, it’s me. I’m in trouble and I need money right away. Please don’t tell anyone yet.”
- Urgent request
- Sounds like family
- Asks for money
Example fake video call setupIllustration
From: meeting-request@example-mail.com
Subject: Please join this quick video call
Someone emails you asking to set up a meeting, which is then followed by a real-time AI voice clone or video deepfake call.
Join Meeting- Unexpected meeting request
- Impersonation
- Verify independently
AI voice cloning
Criminals can use AI to replicate a person's speech from as little as a 3-second clip to later impersonate you for fraudulent activities.