Phishing is the most reported type of cyber scam in the United States and worldwide, and these attacks continue to rise and evolve every day. In 2024, the Better Business Bureau established National Scam Survivor Day, observed on the second Thursday in May. Throughout the month, the BBB, FBI, and National Cybersecurity Alliance lead awareness campaigns focused on common scams and prevention strategies. As phishing scams grow more sophisticated, retirees and high-net-worth (HNW) individuals must stay vigilant because even the most careful investors can fall victim to scams that result in significant financial loss and disruption.
Phishing 101: The basics
Phishing gets its name from the idea that attackers are “fishing” for victims by using spoofed or fraudulent messaging as bait. It’s a type of online scam where someone pretends to be a trusted source to trick you into sharing your personal details, login credentials, or payment information. These attacks can come through email, text, phone calls, or anywhere online and can result in identity theft, hacked accounts, and lost funds.
Common types of phishing attacks
- Email phishing (Mass-market impersonation): The most common form of phishing. Attackers send fraudulent emails that appear to come from government agencies or other legitimate entities, urging recipients to click on links, open attachments, or provide sensitive information. For example, scammers have recently impersonated the IRS during tax season, sending emails claiming an issue with a taxpayer’s return or refund. Corporations and their employees in various industries are also being targeted. Regulators have recently issued warnings about an “agent phishing” scam in which attackers have pretended to be the National Insurance Producer Registry (NIPR), sending fake past-due invoice emails to insurance agents, applicants, and administrators.
- Spear phishing (Targeting): Attackers specifically target high-value victims and organizations using specific or personalized information to make the attack appear legitimate. This is highly effective because attackers tailor messages to the recipient, such as referencing a conference or recent event the recipient may have just attended or using filenames tied to topics of interest.
- Vishing (Voice phishing): Scammers use phone calls to impersonate legitimate individuals or organizations, often claiming urgent issues to pressure victims into providing sensitive information. Recent attacks increasingly use AI-generated voices to mimic real people and sound more convincing.
- Smishing (SMS/text phishing): Similar to email phishing but conducted through text messages. If your phone number has been exposed after a data breach, you may find yourself on the receiving end of more smishing attacks. USPS scam texts are a common example, where fake delivery or purchase notifications urge you to tap a link to confirm or resolve an issue.
- And other tactics: Fake public Wi-Fi networks, lookalike website domains, pop-up internet ads, and various other methods.
Hook, line, and sinker: Red flags to watch for
Phishing emails and messages often rely on familiar names and urgent language to prompt quick action. Be cautious of emails or messages that appear to come from well-known, trusted organizations like LinkedIn, Amazon, or the IRS.
- Always look closely for misspellings or added/substituted characters in the sender address. Legitimate companies use official domains, for example Amazon emails will come from an address ending only in “@amazon.com,” not “@amazon-support.com” or other variations.
- The IRS, SSA, and other official U.S. government agencies will never initiate contact through email, text, or social media.
- Watch for generic or suspicious subject lines, such as “Mail Notification: You have 5 Encrypted Messages,” “Undelivered Mail Returned to Sender,” or “Action required: Your payment was declined.”
Other common red flags can include:
- Poor grammar, generic greetings, unexpected prizes and offers, and requests for personal information.
- Urgent threats such as account suspension or limited-time demands to act.
- Subtle changes like “rn” instead of “m” in links and URLs.
- Unusual attachments or file names from unknown senders.
- Poorly formatted emails, broken links, multiple fonts, or colors and logos that don’t match the company’s official branding.
Additionally, the Department of Social Security Administration (SSA) has identified four key warning signs to help recognize and avoid scams, known as the four Ps:
- Pretend: Scammers pretend to be a trusted source
- Problem: Scammers will fabricate an issue to intimidate recipients
- Pressure: Scammers will pressure recipients to act immediately
- Pay: Scammers will request payment in specific ways such as through gift cards, online transfers, or money orders.
How to protect yourself
- Think before you click: If you receive a suspicious invoice or request from an email claiming to be from USPS, FedEx, Amazon, or another organization, do not open any attachments, click any links, or submit payment. Instead, verify the legitimacy by contacting the organization directly using an official email address, phone number, or secure message center.
- Use strong, unique passwords: Passwords should be long, complex, and never based on birthdays, pet names, or other personal details. Shoot for 16 characters or more, including a mix of letters, numbers, and special characters.
- Multi-factor authentication (2FA): More sites and apps now offer two-factor authentication, adding an extra layer of security beyond a username and password. By requiring multiple forms of verification, it makes it much harder for cybercriminals to gain access to your account.
- Antivirus security software: Install reputable antivirus security software, and keep software and devices updated automatically, to detect and thwart phishing campaigns in real time. Forbes lists Norton, TotalAV, Avast, Aura, and McAfee among top-rated security software options for 2026.
You’ve worked hard to build and preserve your financial security. Don’t let it be compromised by a moment of uncertainty. Always verify before responding. If something doesn’t look right, trust your instincts!
As licensed financial professionals, we are committed to helping you protect and preserve your wealth in every way we can. If you ever receive a suspicious message, our team is here as a resource to provide a second opinion before you take action. You can reach JW Financial Consulting in Scottsdale at 480.793.5924.
Sources:
https://www.fbi.gov/how-we-can-help-you/scams-and-safety
https://victimsofcrime.org/event/scam-survivor-day/
https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams
https://www.statista.com/topics/8385/phishing/#topicOverview
https://www.consumerfraudreporting.org/current_top_10_scam_list.php
https://lifelock.norton.com/learn/fraud/types-of-phishing
https://www.csoonline.com/article/563353/8-types-of-phishing-attacks-and-how-to-identify-them.html
https://www.kaia.com/2025/06/02/phishing-scam-targeting-agents-be-aware/
https://department.va.gov/privacy/fact-sheet/the-four-ps-of-spotting-fraud/
https://www.amazon.com/gp/help/customer/display.html?nodeId=Teu845SZK0ApsIgmGC
