Credential phishing is a deceptive attempt to steal the information used to sign in to an account. An attacker pretends to be a trusted bank, employer, colleague, service, or help desk, then steers you to a fake login page or persuades you to disclose a password or verification code. A polished message is not proof that it is real: verify the requested action and the destination through a channel you find independently.
What credential phishing means
Phishing is a form of social engineering: a person or group uses a deceptive message or website while posing as a trustworthy entity to get someone to disclose information or take an unsafe action. Credential phishing is phishing specifically aimed at login information, such as a username and password or an account verification code. The FBI describes how a message can ask you to update or verify information and send you to a spoofed site resembling a real bank or card website, where the information you enter is collected. CISA’s 2024 phishing-awareness postcard and the FBI’s spoofing and phishing guidance explain these tactics.
As an Amazon Associate I earn from qualifying purchases.
Impersonation and spoofing are related, but not identical
Impersonation is the trust-building move: the attacker claims to be a familiar institution, business, employer, co-worker, or support worker. Spoofing disguises identifying details—such as an email address, caller number, sender name, or website URL—to make that claim look credible. A one-character change in a sender address or web address can be enough to mislead someone. Spoofing can support phishing, but phishing is the broader deceptive attempt to obtain information or prompt an unsafe action.
How an impersonation attack gets from a message to an account
Credential phishing can arrive through email, text, a phone call, or a search result. CISA and the FBI describe related forms including spearphishing, whaling, vishing (voice calls), and smishing (texts). The route changes, but the aim is similar: borrow trust, create a reason to act, and capture information or access.
#1 Best Overall
- The attacker borrows a credible identity. The sender or caller claims to represent a bank, employer, government service, colleague, service provider, or help desk. The displayed name or logo can look familiar even if the actual address, number, or destination is not legitimate.
- A pretext makes the action feel necessary. The message may claim there is unusual account activity, a payroll or employee-portal issue, an account update, or an urgent problem. It may direct you to a link, attachment, phone number, new portal, or request for an authentication code.
- The attacker captures a login or code. A fake sign-in page may closely resemble the real one. In other cases, a caller posing as a bank representative may ask for a one-time passcode, or a person may be persuaded to disclose information in a conversation.
- The stolen details can be used against the account. An attacker may sign in, change account settings, access personal or workplace information, or alter payroll or benefits details to redirect payments. Stolen personal information can also be used to create fraudulent accounts.
A search result can be part of the impersonation
In an April 2025 FBI notice, the FBI warned that fraudulent search advertisements could imitate employee self-service websites. A fake result may appear above the legitimate site and use a URL with a small misspelling. After a worker enters credentials, criminals may seek an MFA token and change direct-deposit details. The practical lesson is that being at the top of a search page does not establish that a site is the real employer portal.
How to tell whether a message or call is really from your bank
Do not judge authenticity by how professional a message looks. Instead, check whether the request makes sense and whether you reached the service through a route you already trust. A familiar name, logo, or caller ID can be faked.
- Check the exact sender and destination. Look at the full email address and the URL that opens, not just the displayed sender name or logo. Watch for small spelling changes or extra characters.
- Be cautious about secrets and codes. Treat unexpected requests for a password, PIN, one-time password, or login verification code as suspicious. The FBI advises against replying to messages or calls asking for these details.
- Notice pressure, but do not rely on grammar. Urgency, surprise account problems, unsolicited links, and unexpected attachments are warning signs. Typos can be a clue, but fluent, polished writing does not establish legitimacy.
- Verify somewhere else. Do not use a link or phone number in the suspicious message to check whether it is genuine. Type the organization’s known address, use a bookmark you saved earlier, or call a number from a card or official source you locate independently.
If a bank message says your account needs attention, open the bank’s app or website using your usual route or call the number on your card. Ask whether the request is genuine. Do not test the link first.
Recommended Free Tools
What to do if you clicked a phishing link and entered your password
Act quickly, using the account provider’s independently verified contact method rather than returning to the suspicious link. If money, payroll, or benefits are involved, contact the relevant bank, employer, or benefits provider immediately and ask them to take protective action.
- Contact the provider and regain control. Tell the account provider that you entered credentials on a suspicious page. Follow its instructions to secure or recover the account.
- Change exposed passwords. Change the compromised password and any other account passwords that reused it. Use a unique password for each account.
- Review recent activity. Check for unfamiliar sign-ins, transactions, changed contact details, forwarding rules, or other account changes. Report anything you do not recognize to the provider.
- Protect payment or workplace records. If direct-deposit, payroll, banking, or benefits information may have been exposed, alert the responsible organization promptly so it can review the details and limit further harm.
- Report suspected cybercrime. You can submit a report to the FBI’s Internet Crime Complaint Center (IC3). The FBI says a timely report with transaction information may help its Recovery Asset Team assist with freezing funds in some cases; that possibility is not a guarantee of recovery.
If you gave a caller a verification code rather than typing it into a page, treat the account as exposed too. Contact the provider through its verified route and explain that the code was disclosed.
Ways to reduce the chance of credential theft
- Use unique passwords. A password manager can help create and keep track of distinct passwords, so a stolen password from one service is not automatically useful elsewhere. CISA’s phishing-awareness material also recommends password managers; it does not endorse a particular brand.
- Enable multifactor authentication (MFA). MFA adds a layer beyond a password, but it is not a guarantee: an attacker may trick you into entering a code on a fake page or handing it to a caller. Never share a code with someone who contacted you unexpectedly.
- Start from a known route. Use a saved bookmark or type the known site address instead of following an unexpected sign-in link or search advertisement.
- For organizations, make verification routine. External-email labels, monitoring for suspicious sign-ins, stronger MFA practices, and identity checks before help-desk staff change account access can reduce opportunities for impersonators. Staff should be trained to inspect destination URLs and verify requests through established channels.
What reported impersonation figures do—and do not—show
Impersonation scams are a broad category, not a measure of credential phishing alone. The FTC’s 2026 report on 2025 consumer data said consumers reported $3.5 billion in losses to imposter scams in 2025 and nearly one in three fraud reports concerned imposter scams. Those figures do not establish how much was lost specifically to stolen passwords.
Separately, the FTC’s 2024 account of 2023 reports recorded more than 330,000 reports of business impersonation and nearly 160,000 reports of government impersonation, with combined reported losses above $1.1 billion. These, too, are impersonation-scam figures—not a count or loss estimate for credential phishing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
