Six kinds of phishing scams and how to spot each one

Phishing is a message, call or web page that pretends to come from someone you trust so you hand over a password, a card number or a payment. It is not a virus or a program, so there is nothing to uninstall. The defense is knowing the six main types and checking before you act.

The six types

• Bulk email phishing: the same fake message sent to many people.
• Spear phishing: a message aimed at a specific person.
• Whaling: a related attack, named by Microsoft alongside spear phishing.
• Business email compromise: a fake request, often for a payment or new bank details.
• Smishing: phishing by text message.
• Vishing: phishing by phone call.

Microsoft names spear phishing, whaling and business email compromise. Smishing and vishing are common names for the text and phone versions. The US Federal Trade Commission and the UK National Cyber Security Centre describe those channels without always using the names.

Why the types blur

The types are sorted by where the message arrives and by who it targets. Real attacks mix them. A bulk email can lead to a fake login page. A stolen login can then send a convincing spear phishing message from a real account. Microsoft also notes that ransomware almost always starts in phishing messages.

How to check a message

Start by asking whether you have an account with the company or know the sender. If not, the FTC says it may be phishing. If you do, skip the contact details in the message. Type the company's address into your browser or open its official app.

Check links without clicking. On a computer, hover over the link. On a phone, press and hold it. The real domain is the part just before the first single slash, and it must match the company exactly. A normal looking page does not clear a link, because phishing pages can look harmless.

For a payment request or a change of bank details, call the supposed sender on a number you already hold. Do this however senior the sender seems.

What to do if you clicked

Change the password you typed, using a different device. Then contact your bank on a number you know is real. Report the mistake early, because staying silent can make the damage larger.

Some habits make mistakes cheaper. Turn on multi factor authentication for email, banking and shopping. Keep devices updating automatically. Use a password manager, which will not fill a login on a look alike address. Back up your data. Never read a one time code out to a caller.