Phishing and smishing: the scam that keeps evolving

Phishing (email) and smishing (SMS) are attempts to trick you into clicking a malicious link or giving up login credentials. They've gotten dramatically better over the past decade. The classic 'Nigerian prince' grammatical tells are gone — today's phishing emails look exactly like real Amazon order confirmations, real bank alerts, real IRS notices.

Common formats right now

• Package delivery notifications ('We couldn't deliver your package — click here to reschedule').
• Fake bank fraud alerts ('Suspicious transaction — verify your account or we'll freeze it').
• Apple/Microsoft/Google account 'security warnings' asking you to log in.
• Tax return fake notices ('You're eligible for a $1,200 refund').
• Subscription renewal alerts ('Your Netflix will be charged $19.99 — click to cancel').
• Text messages impersonating your CEO or boss asking you to 'handle something quickly.'

The four-second check

1. Look at the sender's actual email address, not the display name. Real bank emails come from the bank's domain. Fakes come from slightly-off domains like 'chase-support.xyz' or 'chasee.com.'
2. Hover over links (don't click). The actual URL pops up. If it's not going to the real domain, it's a scam.
3. Ask: did I request this? A random 'package delivery alert' from a service you didn't use is a scam 100% of the time.
4. When in doubt, don't click the link. Open a new tab and go to the real website directly.