Phishing is the most widespread form of cybercrime. Attackers impersonate trusted organizations through email, text messages, phone calls, and social media to steal your passwords, financial information, and personal data. According to the Anti-Phishing Working Group (APWG), phishing attacks have reached record levels. With AI making phishing messages more convincing than ever, protecting yourself requires a layered defense strategy.

This guide covers practical, proven steps to defend yourself against every type of phishing attack.

Understanding the Types of Phishing

Before you can defend against phishing, it helps to understand how it reaches you:

• Email phishing: Fake emails impersonating companies, colleagues, or services you use
• Smishing (SMS phishing): Fraudulent text messages with malicious links
• Vishing (voice phishing): Phone calls from people pretending to be your bank, the IRS, tech support, or other authorities
• Social media phishing: Fake messages, posts, or profiles on platforms like Facebook, Instagram, and LinkedIn
• Spear phishing: Highly targeted attacks using personal information about you specifically

Each type uses the same core tactic: creating urgency or trust to get you to act before you think.

Defense Layer 1: Multi-Factor Authentication (MFA)

MFA is your most powerful defense. Even if a phisher steals your password, they cannot access your account without the second factor.

Best MFA Options (Ranked by Security)

1. Hardware security keys (YubiKey, Google Titan) -- the most secure option; phishing-resistant by design
2. Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy) -- generates time-based codes on your device
3. SMS-based codes -- better than nothing, but vulnerable to SIM-swapping attacks

Where to Enable MFA First

Prioritize enabling MFA on these accounts:

• Email (this is the most critical -- your email is used to reset all other passwords)
• Banking and financial accounts
• Cryptocurrency exchanges
• Social media accounts
• Cloud storage (Google Drive, Dropbox, iCloud)
• Any account containing sensitive personal information

Defense Layer 2: Password Manager

A password manager does two critical things for phishing protection:

1. Generates unique, strong passwords for every account, so a breach on one site does not compromise others
2. Only auto-fills on the correct domain, meaning it will not enter your PayPal password on a fake paypa1-login.com site

Reputable password managers include:

• Bitwarden (free and open-source)
• 1Password
• Dashlane

Use your password manager for every login. If you navigate to a site and your password manager does not offer to fill in your credentials, that is a strong signal you may be on a phishing site.

Defense Layer 3: Email Phishing Defense

How to Spot Phishing Emails

• Check the sender's actual email address, not just the display name. An email from "Amazon Support" sent from support@amaz0n-service.xyz is phishing
• Hover over links before clicking to see the real destination URL
• Be suspicious of urgency: "Your account will be locked in 24 hours" is a classic phishing tactic
• Look for generic greetings: "Dear Customer" instead of your actual name
• Watch for unexpected attachments, especially .exe, .zip, or macro-enabled documents

What to Do with Suspicious Emails

1. Do not click any links or download any attachments
2. Do not reply to the email
3. If it claims to be from a company you use, go directly to their website by typing the URL in your browser -- never use the link in the email
4. Report the email using your email provider's phishing report feature
5. Forward the email to reportphishing@apwg.org -- see our full guide on how to report a phishing email for provider-specific instructions

Defense Layer 4: SMS Phishing (Smishing) Defense

Text message phishing has surged in recent years. Attackers send fake delivery notifications, bank alerts, and government messages.

Protection Strategies

• Never click links in unexpected text messages -- even if they appear to be from a company you know
• Do not respond to texts from unknown numbers, not even to say "STOP." Responding confirms your number is active
• Be skeptical of shortened URLs (bit.ly, tinyurl) in text messages -- these mask the real destination
• Go directly to the source: If a text claims there is a problem with your bank account or delivery, open the company's app or type their URL directly in your browser
• Forward suspicious texts to 7726 (SPAM) to report them to your carrier, and report the scam to the FTC
• Keep your phone's operating system updated to protect against malware delivered through smishing links

Defense Layer 5: Voice Phishing (Vishing) Defense

Phone scams are increasingly sophisticated, sometimes using AI-generated voices that sound remarkably real.

Red Flags on Phone Calls

• Unsolicited calls claiming to be from your bank, the IRS, Social Security Administration, or tech support
• Callers creating panic or urgency ("Your account has been compromised, you need to act now")
• Requests for personal information, passwords, or PINs
• Instructions to transfer money, buy gift cards, or send cryptocurrency
• Threats of arrest, account closure, or legal action if you do not comply

How to Respond

1. Do not provide any information to the caller
2. Hang up -- this is not rude; it is smart
3. Look up the organization's real phone number on their official website
4. Call them back using the number you found yourself to verify whether the call was legitimate
5. Never trust caller ID alone -- phone numbers can be spoofed to display any number

Defense Layer 6: Social Media Phishing Defense

• Be cautious of messages from strangers, even if they claim to be someone you know
• Verify friend requests -- scammers clone profiles of real people
• Do not click links in direct messages from accounts you do not fully trust
• Set your profiles to private to limit the personal information available to attackers
• Be wary of "too good to be true" offers, giveaways, or investment opportunities promoted through social media -- these are often linked to pig butchering or romance scams

Defense Layer 7: Keep Your Software Updated

• Enable automatic updates for your operating system, browser, and apps
• Update your browser -- modern browsers include built-in phishing protection that blocks known malicious sites
• Use reputable antivirus software that includes real-time phishing protection
• Remove browser extensions you no longer use -- compromised extensions can intercept your data

Quick-Reference: What Legitimate Organizations Will Never Do

| Legitimate companies WILL... | Legitimate companies will NEVER... | |------------------------------|-----------------------------------| | Address you by name | Ask for your password via email or phone | | Send you to their official domain | Request gift card payments | | Give you time to make decisions | Threaten arrest or account closure for not complying immediately | | Have verifiable contact information | Ask you to download software to "fix" a problem they called you about | | Support MFA and security features | Ask for your full Social Security number over the phone |

Related Resources