How to detect – and avoid — phishing scams
October 1, 2026 | 5 minute read
Some 40 years after phishing first emerged, the criminals behind it are as successful as ever at tricking individuals into believing they are dealing with a legitimate party — costing people and organizations billions of dollars.
The FBI describes phishing as the use of unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials. Phishing was the number one cybercrime complaint in the 2024 FBI IC3 report, with over 193,000 complaints.1 How has this scam been so successful for so long?
Cybercriminals rely on deception, urgency or too-good-to-be-true promises to convince their targets to give up sensitive data like login credentials and passwords, credit card numbers, account details, corporate contacts, vendor names or other proprietary information.
A phishing email may spoof a company, such as a bank or online shopping site, or look like it’s from someone you know. These emails can include a link to a spoofed website that looks just like the real one. When an individual navigates to this fake site, cybercriminals will collect usernames, passwords and other data they can use to commit identity theft or drain bank accounts.
Criminals use information gathered from data leaks and social media accounts to deliver phishing scams that are more believable than ever — whether through text, voicemail or web search results. But you can outsmart the scammers by maintaining a healthy level of skepticism when receiving any kind of digital communication and shoring up your best defense: awareness.
Remember that Bank of America — like most other reputable companies — will never ask for account details unless you contact us first. If there’s any doubt, go directly to a trusted source, such as the company’s website, or call to check using a phone number you can independently verify belongs to the company or individual who apparently sent the email.
The telltale signs of phishing
There are often clues that an email is a phishing scam. The following five are the most common.
- There are grammatical, spelling and/or formatting errors in the content. If the email is unsolicited and contains multiple spelling, formatting or other errors, it’s best to investigate further before clicking.
- The “from” address doesn’t match the authentic email address of the sender, especially if it says it’s from a business. If you can’t see the email address, either hover over the sender name or right click on it to show details. Cybercriminals often use fake company email addresses from common, public domains. Or they might create an address that spells the company name just slightly incorrectly.
- The email contains a hyperlink that doesn’t match the destination it claims to be when hovered over. For example, if an email purports to be from a favorite online store needing you to update account information, but the URL shows an unfamiliar address, do not click on the link. Instead, directly type in the store’s website into your browser and navigate to your account details to confirm if anything needs updating.
- The email contains attachments from unknown sources that you were not expecting. Don’t open the attachments since they may contain malware that could infect your system.
- The tone of voice is urgent. Criminals love to use urgency to trick users into taking action without looking too closely. Email with phrases like, “Update your password before we close your account!” should be treated as highly suspect. Never call the phone number on an email you suspect might be a scam.
How to avoid telephone scams
Criminals use phone calls, called voice phishing or “vishing,” to steal information and money. Here’s how you can avoid falling for the latest tricks.
6 tips to help avoid smishing scams
Smishing is a form of fraud that primarily takes place through texts on mobile devices. Learn how to detect and avoid this increasingly common type of scam.
Important Disclosures and Information
Bank of America, Merrill, their affiliates and advisors do not provide legal, tax or accounting advice. Consult your own legal and/or tax advisors before making any financial decisions. Any informational materials provided are for your discussion or review purposes only. The content on the Center for Business Empowerment (including, without limitations, third party and any Bank of America content) is provided “as is” and carries no express or implied warranties, or promise or guaranty of success. Bank of America does not warrant or guarantee the accuracy, reliability, completeness, usefulness, non-infringement of intellectual property rights, or quality of any content, regardless of who originates that content, and disclaims the same to the extent allowable by law. All third party trademarks, service marks, trade names and logos referenced in this material are the property of their respective owners. Bank of America does not deliver and is not responsible for the products, services or performance of any third party.
Not all materials on the Center for Business Empowerment will be available in Spanish.
Certain links may direct you away from Bank of America to unaffiliated sites. Bank of America has not been involved in the preparation of the content supplied at unaffiliated sites and does not guarantee or assume any responsibility for their content. When you visit these sites, you are agreeing to all of their terms of use, including their privacy and security policies.
Credit cards, credit lines and loans are subject to credit approval and creditworthiness. Some restrictions may apply.
Merrill Lynch, Pierce, Fenner & Smith Incorporated (also referred to as “MLPF&S” or “Merrill”) makes available certain investment products sponsored, managed, distributed or provided by companies that are affiliates of Bank of America Corporation (“BofA Corp.”). MLPF&S is a registered broker-dealer, registered investment adviser, Member SIPC, and a wholly owned subsidiary of BofA Corp.
Banking products are provided by Bank of America, N.A., and affiliated banks, Members FDIC, and wholly owned subsidiaries of BofA Corp.
“Bank of America” and “BofA Securities” are the marketing names used by the Global Banking and Global Markets division of Bank of America Corporation. Lending, derivatives, other commercial banking activities, and trading in certain financial instruments are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Trading in securities and financial instruments, and strategic advisory, and other investment banking activities, are performed globally by investment banking affiliates of Bank of America Corporation (“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc., which is a registered broker-dealer and Member of SIPC, and, in other jurisdictions, by locally registered entities. BofA Securities, Inc. is a registered futures commission merchant with the CFTC and a member of the NFA.
Investment products: