Scams targeting older adults are big business. According to a report from the FBI’s Internet Crime Complaint Center (IC3), adults age 60 and older filed more than 201,000 scam complaints in 2025, with reported losses topping $7.7 billion. Compared to 2024, complaints rose 37%, while reported losses surged 59%.¹

“Losing significant money to a scammer would be catastrophic for anyone,” said Jessica Johnston, NCOA Senior Strategist for Economic Well-Being. “And especially so for those of us who don’t have decades of employment ahead to help recover a lifetime of savings.”

One of the most common scams targeting older adults is also one of the internet’s oldest: phishing. In this guide, you’ll learn more about phishing and how to fight back against criminals who want to steal your identity, your money, and your financial security.

What is phishing?

Phishing is a type of internet hoax that’s been used for decades to part unsuspecting consumers with their money and sensitive information. These scammers use email, texting, social media, and other methods to steal personal data, like bank account numbers or account passwords. And you can see where the unusual name comes from: because phishing uses attractive “bait” to lure people to websites and solicit their data under false pretenses.

In 2025, phishing and “spoofing” topped the list of cyber fraud complaints, with 191,561 complaints totaling $215,843,126 in reported losses.¹

Phishing is not the same as spam. Spam is just another term for junk mail and unwanted ads; phishing attacks involve deception and trickery to steal your information and use it in harmful ways.

How does phishing work?

All phishing scams share three things in common:

1. They use electronic communications. Phishing attacks commonly happen through email, but criminals also try to contact you via text messages, social media accounts, voicemail, and even phone calls.
2. They use your trust against you. Phishing works by convincing you that a fake email, text, phone call, or social media account is real. The scammer claims to be a person or organization who’s familiar to you (a tactic known as social engineering), which makes the ruse seems credible.
3. Their goal is theft. Phishing attacks are meant to steal sensitive personal information, such as passwords, bank details, Medicare and Social Security numbers, credit cards, and more.

All phishing attacks use carefully crafted appeals to get you to click on a link, download an attachment, or provide specific personal information. In some cases, scammers may even ask for payment. We’ve even seen scammers use vaccines as an excuse to steal Medicare numbers.

What are common types of phishing scams?

Some other typical phishing attack examples include:

• You have an unpaid invoice. Like many phishing attacks, this type of scam uses fear and urgency to pressure you into paying for products or services you never ordered or received. For example: You get an email claiming you owe $589 for a recent “computer virus protection renewal” or online purchase you don’t recognize. The message warns your credit card will be charged within hours unless you click a link or call a customer support number. In reality, the invoice is fake, and the scammer is trying to steal your financial or personal information.
• Your help is urgently needed. With a goal of tugging at your heartstrings, the attacker sends you an email pretending to be a good friend or relative (like your grandchild). They claim to be in dire financial straits and urgently request that you send them money. How can cyber criminals so easily impersonate people you know? With social media, scammers have access to more of our personal information than ever before. This allows them to craft messages that often are very believable.
• You won a big prize. Scammers text you with congratulations and great news: you’ve won a very big prize, whether it's an irresistible travel package or free tickets to the event of the year. But first, in order to claim your award, you have to volunteer personal information or even pay an up-front fee.
• Your bank account was compromised. Criminals impersonate someone from your financial institution and send an “urgent” notice to alert you about suspicious activity on your account. This notice directs you to click a link that brings you to a real-looking website (it’s fake), where you’re prompted to confirm your bank account details.
• The government is after you. Few things in life are as jarring as receiving a sternly worded notice from the Internal Revenue Service (IRS). Scammers know this, which is why many of them send phishing emails that look like they’re from the U.S. government. These emails typically have a threatening tone and mention big, scary penalties—“penalties” you can “avoid” if you simply offer the payment or personal data they demand. In some cases, criminals send these types of phishing emails and texts during tax season, lending them extra credibility. These scams offer a generous refund after you confirm your financial details.

After receiving what appeared to be a legitimate call from his bank, 67-year-old Sherman Johnson immediately sensed something was off. The caller sounded convincing and even knew his bank routing number—but Johnson trusted his instincts instead of acting on the spot.

"I had a feeling—like a pit in my stomach—that something wasn't right," Johnson said at an NCOA/JPMorgan Chase scams prevention workshop. 

Rather than following the caller's instructions, Johnson hung up and contacted his bank directly. That simple step confirmed his suspicion and helped him avoid becoming a victim.

"Instead of following the caller's instructions, I hung up and called my bank directly. The bank said they never called me," Johnson said.

Why does phishing work so well?

Emails, text messages, voicemail messages, and even voice calls are not authenticated. This means that—just like a postcard sent through the mail—there’s no real way to tell where they actually come from. That gives scammers plenty of freedom to mimic trusted people and brands in their communications.

The most accomplished phishers are very skilled at creating spoof (fake) emails and websites that are almost impossible to tell apart from the real thing. That includes the URL (website address) and security certificates. You may think you’re reading a credible message from a bank, online store, credit card company, or the government. Unless you’re paying very close attention, you might miss the signs of trickery until it’s too late.

And today, scammers have one more trick up their sleeve: They’re using artificial intelligence (AI) to further their criminal goals. The advancement of AI tools is accelerating phishing attacks by allowing scammers to:

• Generate hundreds of personalized variations of a message in the same amount of time it used to take one person.
• Eliminate spelling errors and produce messages with native-level grammar and a natural tone.
• Quickly incorporate current events, company news, and other timely details into phishing messages, making them feel more legitimate and harder to recognize as scams.

In 2025, IC3 received more than 22,000 complaints involving AI-related scams and cybercrime, with reported losses totaling more than $893 million.¹

How do you avoid phishing scams?

The good news: phishing scams have signs, and it’s possible to spot them. Knowing how to protect yourself against phishing emails and texts means knowing what to look for. While scammers constantly change their approaches to evade detection, there are certain red flags that can tip you off to trouble.

According to the Federal Trade Commission (FTC), some telltale signs of a phishing email or text message are when it:

• Has a generic greeting instead of using your name
• Invites you to click on a link to update your payment details
• Asks you to click on a link to make a payment
• Says your account is on hold because of a billing problem
• Claims you’re eligible for a government refund
• Includes an invoice you don’t recognize
• Says they’ve noticed some suspicious activity or log-in attempts
• Offers a coupon for free stuff (or a “too good to be true” prize)

• Says there’s an issue with your account or your payment information

The best defense against a phishing scam is to verify with the person or organization(s) who sent the email or message before clicking on anything. Remember that you can never be 100% certain that the sender of an email, text message, voicemail, or phone call is who they say they are. That’s why it’s important to approach every communication with a healthy dose of skepticism.

What should you do if you think you've been targeted by a phishing scam?

1. Don’t click on any links found within emails or text messages if you didn’t initiate the original message. Be suspicious of all unsolicited and/or unexpected communications.
2. Do navigate to trusted websites directly by typing the web address into the browser address bar yourself. Don’t click through a link.
3. Do verify website security certificates by clicking the small padlock icon in the left corner of the browser address bar. Make sure the URL begins with “HTTPS.” An HTTPS connection is protected by a special type of security technology, which means that any information you send through the website is kept private.
4. Don’t send personal information in email or text messages. Again, this information is not secure, and you can’t be sure who the recipient is. Always verify who someone is before sharing any data with them. 
5. Don’t ever give out personal information over the phone during calls you didn’t make yourself. Always double-check to make sure you’re using the correct phone number of the person or business you’re trying to contact.
6. If you encounter a scam (or believe you have), report it. Call the National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311). Reporting the incident can help authorities track trends and issue alerts to help protect other consumers.  

The bottom line

When it comes to preventing phishing scams, education is a powerful way to protect yourself. Phishing scams are designed to create urgency and trick you into sharing personal or financial information. If something feels suspicious, pause, verify the sender independently, and never click links or share sensitive information until you've confirmed the request is legitimate.

Source

1. Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3). Internet Crime Report 2025. Found on the internet at https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf