We write a lot about patient, deliberate ways to build wealth. This series is about the other side of that coin: the deliberate, patient ways other people try to take it from you. According to the FTC, Americans reported losing a record $15.9 billion to fraud in 2025, up from $12.5 billion the year before — and separate FTC estimates that account for underreporting suggest the true cost to older adults specifically may run as high as $81.5 billion a year, far above what gets formally reported. Imposter scams alone accounted for $3.5 billion in reported losses in 2025, the fifth consecutive year they've led every fraud category.
This series starts at the beginning, because the beginning is where most scams still succeed: a message, a call, or a link designed to get you to act before you think. Later installments will cover investment and crypto-specific scams, romance and relationship scams, and the impersonation schemes that specifically target older adults with claims about a grandchild in trouble or a government agency demanding payment. Part 1 is the foundation everything else builds on.
What phishing actually is
Phishing is any attempt to trick you into handing over sensitive information — passwords, account numbers, one-time verification codes — or into taking an action, like wiring money or buying gift cards, by impersonating someone or something you trust: your bank, the IRS, Amazon, a delivery service, even a family member. The name comes from "fishing" — casting out a wide net of fake messages and waiting for someone to bite. It's been around since the earliest days of email, and it still works because the underlying trick hasn't changed even as the delivery method has multiplied. The FTC's consumer guide to phishing walks through the current version of the pattern in more detail.
The three channels it arrives through now
- Phishing (email). The classic version: an email that looks like it's from your bank, a shipping company, or a service you use, with a link to a fake login page designed to capture your username and password the moment you type them in.
- Smishing (SMS/text). The same trick delivered by text message — a fake "package delivery issue," a fake bank fraud alert, or a fake toll-road payment notice, each with a link to a convincing but fraudulent site. Smishing has grown sharply because people tend to trust text messages more than email, and because it's harder to hover over a link on a phone to preview where it actually goes. The FTC has a guide to recognizing and reporting spam text messages.
- Vishing (voice/phone). A phone call, often with a spoofed caller ID that displays your actual bank's real phone number, from someone claiming to be bank security, the Social Security Administration, or a law enforcement agency. The newest version of this uses AI-generated voice cloning to impersonate a specific person — a family member's voice, built from a few seconds of audio pulled from social media — which is a meaningfully different threat than the generic scam calls of even a few years ago. See the FTC's overview of common phone scams for more patterns to watch for.
The red flags that hold up across all three channels
- Urgency and fear. "Your account will be suspended in 24 hours." "A warrant has been issued for your arrest." Scammers manufacture urgency because it short-circuits the pause where you'd normally think something through or call someone for a second opinion.
- A request for an unusual payment method. Gift cards, wire transfers, cryptocurrency, or payment apps to a stranger are the preferred tools of scammers specifically because they're difficult or impossible to reverse. No legitimate bank, government agency, or utility company asks to be paid in gift cards.
- A request for a one-time verification code. If you receive a text with a 6-digit code and then get a call or message asking you to read that code back, stop — that code exists specifically to prove a login attempt is you, and reading it to someone else hands them access to your account. Legitimate companies never ask for it.
- Pressure to keep it secret. "Don't tell your bank why you're withdrawing this money" or "don't mention this call to your family" is one of the most reliable scam indicators there is — it's designed specifically to prevent the outside perspective that would expose the scam.
- A link or phone number provided within the suspicious message itself. This is the single most important habit to build: never use the contact information contained in a message you're suspicious of. A real bank's fraud department can be reached at the number on the back of your card or your monthly statement — not a number a text message just handed you.
The one habit that stops almost all of it
If a message or call claims to be from an institution you have an existing relationship with — a bank, a credit card company, a government agency — hang up or close the message, and independently look up that institution's official phone number yourself, from a statement, the back of a card, or the official website typed directly into your browser. Then call that number. This single habit defeats spoofed caller ID, fake links, and cloned voices all at once, because it removes the scammer's control over which "official" contact point you actually reach.
If you think you've been targeted
- Don't act on anything in the moment. Hang up, close the message, and give yourself time before doing anything the message asked for.
- Verify independently using contact information you already had, not information the message provided.
- Report it at ReportFraud.ftc.gov, and to your bank directly if any account information or a payment was involved.
- Tell someone. A scammer's biggest advantage is isolation — a second opinion from a family member or friend, even after the fact, helps catch what a rushed, alone decision missed.
Next in this series: the investment and crypto-specific scams built to look like the legitimate opportunities we cover on this site every week — and how to tell the difference before money changes hands. Update: Part 2, on AI voice cloning and the family-emergency scam, is live now.