Phishing & Social Engineering

Don’t Take the Bait. Learn to Recognize the Warning Signs.

Scammers don’t always need to hack into a computer to steal information. Sometimes, all they need is for someone to click a link, open an attachment, or share information they shouldn’t.

This is known as phishing or social engineering. Criminals use deceptive messages, phone calls, websites, and personal interactions to trick people into giving away sensitive information or sending money.

What is phishing?

Phishing occurs when someone pretends to be a legitimate person or organization to obtain personal or financial information. These messages may appear to come from:

  • Your bank or another financial institution.
  • A government agency.
  • A well-known company or online retailer.
  • A delivery service.
  • An employer, coworker, or family member.

Common warning signs

Be cautious if you receive a message that:

  • Creates a sense of urgency, such as claiming your account will be locked.
  • Requests passwords, PINs, or verification codes.
  • Contains unexpected links or attachments.
  • Offers prizes, refunds, or unexpected payments.
  • Has unusual spelling, grammar, or formatting.
  • Comes from an email address or phone number that doesn’t match the organization it claims to represent.

What is social engineering?

Social engineering is when scammers manipulate people into taking actions that benefit the criminal. They may pretend to be someone you trust, create an emergency, or convince you that immediate action is necessary.

For example, someone may call claiming to be from your bank’s fraud department and tell you that your account is compromised. They may then ask you to provide a verification code or transfer money to a supposedly safe account.

Remember: A legitimate-looking caller or message does not automatically mean it is genuine.

How to protect yourself

  • Never click unexpected links in emails or text messages.
  • Don’t open attachments from unknown or suspicious senders.
  • Never provide passwords, PINs, or one-time verification codes to someone who contacts you unexpectedly.
  • Verify requests by contacting the organization using a trusted phone number.
  • Avoid sharing sensitive personal information on social media.
  • If something feels suspicious, stop and investigate before responding.

What should you do if you clicked a suspicious link?

If you believe you have interacted with a phishing message:

  1. Stop communicating with the sender.
  2. Do not enter any additional personal or financial information.
  3. If you provided a password, change it immediately using the legitimate website or application.
  4. Contact your financial institution if banking information may have been exposed.
  5. Monitor your accounts for unauthorized activity.

Remember

Stop. Look. Think.

Scammers rely on urgency and emotion to get you to act without thinking. Take a moment to verify before clicking, responding, or sharing information.