The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Phishing scams still work because a message can imitate someone you trust and push you to act before you check it. The safest response is to pause, avoid its links and attachments, verify the request through a contact method you already trust, and protect important accounts with multifactor authentication (MFA).
What phishing is—and why it still works
Phishing is an attempt to impersonate a trusted person or organization to get you to reveal information, send money, visit a fake website, or open a harmful attachment. It can arrive by email, text, phone call, or other channels.
As an Amazon Associate I earn from qualifying purchases.
The trick is not necessarily a clumsy message. Scammers may use familiar branding and convincing language, or disguise a sender name, email address, phone number, or website URL. The FBI warns that a spoofed address or URL can differ from a legitimate one by only a character, and that fake websites can resemble financial sites. A polished logo or familiar name is therefore not proof that a message is genuine. See the FBI’s guidance on spoofing and phishing.
Free tools Windows power users keep installed
One-click scans. No signup required.
A request may appear to come from a company you use and ask you to confirm account details or pay an overdue invoice. At work, it may look like a vendor changing payment instructions or a boss asking for urgent action. The pressure to respond quickly can crowd out the simple check that would expose the deception. The same tactic applies to an unexpected text or call, not just email.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to spot and verify a suspicious request
Unexpected urgency is a reason to pause, not a reason to comply. Treat requests involving payment changes, passwords, account warnings, or sensitive information as unverified until you confirm them independently.
- Do not use a link, attachment, phone number, or reply address supplied in the suspicious message.
- Visit the organization’s website by typing an address you already know, or use a trusted phone number from a card, statement, or saved contact.
- For an unusual workplace payment or credential request, confirm it through a second channel you already trust.
- Check the sender details carefully, but do not rely on them alone: spoofed addresses and lookalike URLs can be difficult to distinguish.
The FTC’s advice is direct: “Don’t click links or download attachments in unexpected messages.” The FBI similarly says, “Don’t click on anything in an unsolicited email or text message.” Read the FTC’s consumer guidance on phishing and the FBI’s spoofing and phishing guidance.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which defenses help—and what each one does
No single measure covers the whole attack. Filtering, independent verification, stronger sign-in, and business email authentication address different points in the process.
| Defense | What it helps with | Practical use |
|---|---|---|
| Email filtering | Reduces the number of suspicious messages reaching your inbox. | Leave your provider’s spam filter enabled and mark messages that get through as spam or junk. |
| Verification habits | Reduce the chance you act on a deceptive request. | Use a known website or contact number instead of the details in the message. |
| MFA | Adds a sign-in check beyond a password, reducing account-takeover risk if a password is exposed. | Enable it on email and financial accounts first, then other important services. |
| Phishing-resistant authentication | Helps prevent an attacker from using stolen credentials on a fake sign-in site. | Choose FIDO/WebAuthn sign-in where the account and your devices support it. |
| SPF, DKIM, and DMARC | Help receiving systems assess email sent using a business’s domain. | Businesses should configure these protections carefully so legitimate mail is not blocked. |
Use MFA, and prefer phishing-resistant sign-in when available
Turn on MFA for important accounts, especially email and financial services. CISA says any MFA is better than none and advises organizations to move toward phishing-resistant options. Where those methods are not yet available, number matching can be an interim option in CISA’s guidance.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
CISA identifies FIDO/WebAuthn as the widely available phishing-resistant authentication method and says it blocks an attempt to log in through a fake website. Its guidance states, “The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” A compatible hardware security key is one physical way to use this standard, but check that your account, browser, device, and key are compatible before buying one. A security key strengthens sign-in; it does not replace checking unexpected messages or protect every channel a scammer might use. See CISA’s More than a Password and MFA guidance for small and medium businesses.
For businesses: configure email authentication carefully
SPF, DKIM, and DMARC help receiving systems assess whether messages using a business’s domain are authorized. Configuration can require expertise: overly strict or incorrect settings may block legitimate email. The FTC outlines these measures in its Cybersecurity for Small Business guidance.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do if you received or acted on a phishing message
If you have not interacted with it
- Do not reply, click a link, open an attachment, or provide information.
- If the message claims to be from an organization you use, contact it using a known legitimate website or number—not details in the message.
- Report the attempt. The FTC accepts reports at ReportFraud.ftc.gov and says you can forward phishing emails to [email protected]. The FBI directs phishing and spoofing reports to IC3.gov.
If you entered a password or other information
- Use the genuine service’s account-recovery process and change the affected password.
- If you reused that password elsewhere, change it on those accounts too.
- Contact the impersonated organization through a known channel if the message involved a payment, account, or other sensitive request.
- Report the attempt through the FTC or FBI channels listed above.
What the reported figures can—and cannot—tell you
The FTC reported that consumers lost $3.5 billion to imposter scams in 2025, and that nearly one in three fraud reports that year concerned imposter scams. Those scams used multiple channels, including text, phone, email, social media, and search results; the figure is not a phishing-only loss estimate. The FTC published the figures in its 2026 release on 2025 imposter-scam reports.
In its 2025 release on the 2024 Internet Crime Report, the FBI said phishing and spoofing were among the three most frequently reported cybercrime categories. IC3 received 859,532 suspected internet-crime complaints and reported losses exceeding $16 billion overall. That total covers internet-crime categories broadly; it is not a phishing-loss figure. Complaint counts and broad fraud losses also do not establish the probability that any particular message is malicious or will succeed. See the FBI’s annual Internet Crime Report release.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
