Phishing Recognition and Reporting: Complete Guide

Phishing is the cybercrime Americans report most often. The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025 with reported losses of $20.877 billion, and phishing/spoofing was the most-reported crime type, with 191,561 complaints (IC3 2025 Internet Crime Report). The Anti-Phishing Working Group (APWG) counted 3.8 million phishing attacks during 2025, slightly more than the 3.76 million in 2024 (APWG Q4 2025).

This guide covers how to recognize phishing across channels, how to report it to the right places, and which defenses actually reduce the damage when a message gets through.

What Phishing Actually Is

Phishing is a social engineering attack that uses fraudulent communications (email, SMS, voice calls, QR codes or fake websites) to trick people into revealing credentials, installing malware or authorizing payments. The common thread is impersonation: attackers pose as banks, employers, government agencies, colleagues or suppliers.

Phishing has several specialized variants. Spear phishing targets specific individuals with researched pretexts; our spear vs. bulk phishing comparison explains the difference. Whaling goes after executives. Business email compromise (BEC) manipulates invoice and payment workflows. Smishing uses text messages and vishing uses voice calls. Each exploits a different channel of trust, but the recognition principles overlap.

Recognizing Phishing: The Five-Point Check

Five quick inspections work on almost any message.

1. Sender Verification

Look at the full sender address, not just the display name. Attackers register lookalike domains that swap characters or add words such as “secure” or “support” to a brand name. In your email client, expand the From field to see the actual domain. For a deeper look, the message headers show SPF, DKIM and DMARC results; our email header analysis guide walks through them. Remember that a message from a genuinely compromised account will pass these checks.

2. URL Inspection

Hover over links (or long-press on mobile) before opening them. Check for:

Misspelled or lookalike domains (for example, “rn” standing in for “m”)
A trusted brand name placed in a subdomain of someone else’s domain, such as login.bank.example-attacker.com
URL shorteners that hide the real destination
Login pages served over plain HTTP

HTTPS is not a sign of legitimacy: phishing sites use certificates too. Our URL inspection guide covers more techniques.

3. Urgency and Pressure Tactics

Phishing messages manufacture urgency: “Your account will be suspended in 24 hours,” “Unauthorized login detected,” “Payment overdue, act now.” Pressure to act before you can think, or to keep a request secret, is a warning sign. Our social engineering red flags guide catalogs the psychological triggers.

4. Attachment and File Analysis

Unexpected attachments, especially .exe, .zip, .js, .docm or .html files, are high-risk. PDFs and Office documents can carry malicious links or macros. Never enable macros in a document you were not expecting.

5. Request Validation

Any message asking for credentials, financial information, wire transfers, gift cards or a change of bank details should be verified through a separate channel. Call the sender on a number you already have, not one in the message. A voice or video call that the other party set up is not verification on its own, because voices and faces can now be faked.

Phishing by Channel

Email Phishing

Email remains a central channel, and lures follow the money and the logins. In Q2 2026, SaaS/webmail services were the most-targeted sector at 29.1% of phishing attacks, followed by payment services (13.2%) and financial institutions (11.4%), according to Crane Authentication data in the APWG’s Q2 2026 report. The same report describes Fortra seeing more two-step phishing, where a harmless-looking first email draws a reply before the phishing link is sent, and attackers swapping the display name and subject line to evade filters that look for executives’ names.

Key email indicators:

Authentication failures in the headers (SPF/DKIM/DMARC)
A Reply-To address that differs from the sender
Generic greetings (“Dear Customer”) in messages claiming to be from your bank
Requests that bypass normal procedures

Grammar mistakes are no longer a reliable tell. In a 2024 study, fully AI-automated spear-phishing emails were clicked as often as emails written by human experts (Heiding et al.). For email defenses, see our DMARC/SPF/DKIM guide and email filtering best practices.

SMS Phishing (Smishing)

Crane Authentication reported that smishing rose 40% from Q1 to Q2 2026, after what it described in late 2025 as steady 30 to 40% quarter-over-quarter growth in SMS-based fraud detections (APWG Q2 2026 and Q4 2025 reports). Phones show less of a link than a desktop does, and people read texts quickly. Fake toll notices, delivery alerts and bank fraud warnings are common lures: in April 2024 the FBI reported more than 2,000 complaints about smishing texts posing as road-toll collection services in at least three states (FBI PSA I-041224-PSA). See our smishing guide for defenses.

Voice Phishing (Vishing)

Crane Authentication also saw vishing rise 20% from Q1 to Q2 2026. AI makes the impersonation more convincing: the FBI has warned that criminals use AI-generated audio to impersonate public figures and relatives (December 2024), and in May 2025 it warned that malicious actors were impersonating senior US officials with AI-generated voice messages, noting that cloned voices “can sound nearly identical” to the real person (PSA250515). Our vishing guide covers caller verification.

QR Code Phishing (Quishing)

Mimecast detected 655,673 unique malicious QR codes in Q4 2025, down 9% from 716,306 in Q3, according to the APWG’s Q4 2025 report, which also notes that phishers timed some QR attacks to Black Friday week. A QR code hides its destination inside an image, so it can slip past link scanners that do not decode images, and it moves the victim from a protected work computer to a personal phone. Malicious codes turn up in emails, on flyers and on stickers placed over legitimate codes in public places. See our quishing guide for detection and prevention.

Sector-Specific Threats

Different industries see different lures. Healthcare organizations receive lures themed around patient records, billing and benefits. Financial institutions and their customers face credential harvesting dressed up as fraud alerts. Schools and universities see student and staff credential theft and payroll or tuition payment fraud.

Detailed guidance for each sector:

From Bulk to Targeted Attacks

Bulk phishing sends the same lure to huge numbers of recipients and relies on volume. Targeted attacks trade volume for research: spear phishing is tailored to one person or team, whaling targets executives, and BEC targets the people who move money. Targeted attacks are rarer but cost far more per incident. Business email compromise accounted for $3.05 billion in reported losses across 24,768 complaints in 2025, second only to investment fraud, while phishing/spoofing, the most-reported category, accounted for $215.8 million (IC3 2025).

The spear vs. bulk phishing comparison shows how to identify each type. For executive-targeted attacks, see our whaling attacks guide, and for payment fraud, our BEC guide.

How to Report Phishing

Reporting helps get phishing sites taken down, warns other potential victims and gives investigators data to work with.

Reporting to Authorities and Clearinghouses

Where	What to report	How
FBI IC3	Internet crime, especially where money was lost	ic3.gov online complaint
FTC	Phishing, scams and fraud attempts	ReportFraud.ftc.gov
FTC	Identity theft	IdentityTheft.gov
CISA	Cyber incidents affecting organizations	CISA’s online incident reporting form at cisa.gov/report
APWG	Phishing emails	Forward to reportphishing@apwg.org
Your mobile carrier	Scam texts	Forward to 7726 (SPAM)

The FTC itself recommends forwarding phishing emails to reportphishing@apwg.org, scam texts to 7726, and reporting the attempt at ReportFraud.ftc.gov. Our reporting to IC3/FTC guide gives step-by-step instructions.

Reporting to Your Organization

Use your organization’s report button or forward the message to the designated security address. Do not forward phishing emails to colleagues as a warning, which spreads the threat; let the security team send any alert.

Reporting to Email Providers and Hosts

Major webmail services, including Gmail and Outlook.com, have built-in options to report phishing. If a message impersonates a brand, report it to that company’s abuse or security team too. Reporting the hosting provider or registrar behind a phishing site helps get it taken down; our reporting to ISPs guide covers the process.

Building Organizational Defenses

Technical Controls

Email authentication. Publish SPF and DKIM, then move DMARC to p=reject once legitimate senders align. This stops spoofing of your exact domain; it does not stop lookalike domains or mail from compromised accounts. NIST’s SP 800-177 Rev. 1, Trustworthy Email covers the standards. See our DMARC/SPF/DKIM guide.
Multi-factor authentication. Any MFA is better than none, but SMS and app codes can be phished or relayed in real time. Phishing-resistant MFA (FIDO2 security keys, passkeys) will not authenticate to a lookalike site, which CISA calls “the gold standard” (CISA fact sheet). It does not protect against every attack, such as malware that steals session tokens or a user approving a malicious app. Our MFA guide compares options.
Email filtering. Gateways and platform-native protection with URL rewriting, sandboxing and attachment detonation catch much of the known-bad mail. See our email filtering guide.
Zero trust architecture. The principles in NIST SP 800-207, including continuous verification and least-privilege access, limit what a stolen password alone can reach. Our zero trust guide explains implementation.
Browser security. Keep built-in phishing and malware protection turned on and do not click through certificate warnings. See our browser security guide.

Human Controls

Security awareness training. Treat training as one layer, not the solution. In an eight-month randomized experiment with more than 19,500 UC San Diego Health employees, recent annual training showed no significant relationship with phishing simulation failures, embedded training lowered failure rates by only about 1.7 percentage points, and more than 56% of employees clicked a phishing link at some point (Ho et al., IEEE S&P 2025). Make reporting easy and reward it. See our phishing simulation guide and security training ROI analysis.
Incident response planning. A written, rehearsed plan means people know who to call and what to shut off. See our corporate incident response guide.
Credential compromise procedures. When credentials are stolen, speed matters. Our credential compromise response guide is a step-by-step checklist.

What to Do If You Clicked

Mistakes happen even with good defenses. If you clicked a phishing link or entered credentials, act quickly.

Immediate Actions

Disconnect the device from the network if you may have downloaded malware
Change the password for the affected account from a different, trusted device
Turn on MFA if it is not already active; see our MFA guide
Check for unauthorized changes, such as email forwarding rules, recovery phone numbers and connected apps
Tell your IT security team or designated contact right away

Follow-Up (First 24 Hours)

Change passwords on any other accounts where you reused the compromised password
Watch financial accounts for unauthorized transactions
Run a full malware scan on the device you used
Review account activity logs for signs of unauthorized access
File reports with IC3 or the FTC and the impersonated organization

For organizations, this escalates into a formal incident response process. See the credential compromise response checklist and the corporate incident response guide.

Financial Fraud Recovery

If you authorized a wire transfer, sent money or shared financial information:

Contact your bank immediately and ask for a recall of the funds. The FBI says that when you discover a fraudulent transfer, “time is of the essence”
File a complaint at ic3.gov regardless of the amount, with full transaction details. In 2025 the IC3 Recovery Asset Team worked 3,900 incidents and helped freeze $679 million of $1.16 billion in attempted theft, a 58% success rate (IC3 2025)
Place a fraud alert with one of the three credit bureaus (Equifax, Experian, TransUnion), which must notify the other two
Keep monitoring your credit reports and accounts for at least a year

Phishing Awareness for Specific Audiences

For Non-Technical Users

You do not need to be a security expert. Three habits cover most situations:

Do not use links in unexpected messages. Go to the website or app directly
When in doubt, verify by phone using a number you already have
Report anything suspicious and let your security team make the call

For IT and Security Professionals

Focus on structural defenses that work at scale:

Deploy DMARC at reject on all organizational domains, including ones that never send mail
Require phishing-resistant MFA, starting with administrators, executives and finance staff
Apply zero trust principles to limit what stolen credentials can reach
If you run phishing simulations, measure reporting rates and time-to-report, not just clicks
Maintain a documented incident response plan
Review incidents regularly using phishing forensics techniques

For Business Leaders

IBM and the Ponemon Institute’s Cost of a Data Breach Report 2026 puts the global average cost of a data breach at $4.99 million, a figure covering all industries and causes. Direct fraud losses add to that: BEC alone produced $3.05 billion in reported losses in 2025. Our security training ROI analysis shows how to build a realistic business case.

Emerging Threats

AI-Generated Phishing

AI lets attackers write fluent, personalized lures at scale. In the Heiding et al. study, fully AI-automated spear-phishing emails got a 54% click-through rate, the same as human experts, against 12% for a control group of generic phishing emails. Our AI-generated phishing detection guide covers detection and defenses.

Brand Impersonation at Scale

Attackers copy legitimate brand emails and login pages closely, using lookalike or compromised domains. The targets are not only household names: the APWG identified 941 different brands attacked in Q2 2026, and half of them were attacked five times or fewer. See our brand impersonation detection guide.

Supply Chain Phishing

Attackers pose as, or compromise, trusted vendors so that requests look routine. Fortra described the BEC group it calls Scripted Sparrow using fake executive-coaching invoices and a spoofed reply chain between the “coaching firm” and a company executive to lend credibility (APWG Q2 2026). Verify any change in a supplier’s payment details by calling a known contact. Our supply chain phishing guide explains vendor verification.

Key Takeaways

Phishing/spoofing was the most-reported crime type to IC3 in 2025 (191,561 complaints), and the APWG counted 3.8 million attacks that year
The five-point check (sender, URL, urgency, attachments, request validation) catches many attacks, but not all, so verification habits matter
Report to IC3, the FTC, the APWG (reportphishing@apwg.org), 7726 for texts, CISA’s reporting form for organizational incidents, and your own security team
DMARC, phishing-resistant MFA, filtering and zero trust each address part of the problem; none covers it all
Independent research shows training alone moves click rates only slightly, so make reporting fast and easy
Text, voice and QR-code phishing are growing, and AI has removed spelling and grammar as reliable warning signs

Sources

This content is for educational purposes only. Report suspected phishing to ic3.gov, your IT security team, and the impersonated organization. Do not attempt to engage with or investigate phishing actors on your own.