Phishing scams: how scammers get your card number

What phishing looks like

Phishing is a message that pretends to be a company you know — a bank, a streaming service, a shipping carrier, a utility — and tries to get you to click a link, open an attachment, or hand over personal information. The FTC’s phishing guidance describes the typical play: scammers “use email or text messages to try to steal your passwords, account numbers, or Social Security numbers.”

The stories vary but the structure is constant. There is an urgent problem (a suspended account, a missed delivery, an overdue invoice), a demand to act now, and a link or attachment that is supposed to fix it. The urgency is the tell — real companies do not need you to confirm your card number within the hour.

Why the message looks so convincing

Modern phishing uses real branding, real product names, and occasionally a real data leak that gives the scammer your actual name and account history. The FTC warns that scammers even spoof sender addresses so an email appears to come from the company it is imitating.

The content is engineered to feel normal: a notification from your bank about “suspicious activity,” a delivery alert that matches a package you are actually expecting, a “party invitation” from a friend. Each detail exists to make the link feel safe. The question the FTC tells consumers to ask is simple: “If you get an email or a text message that asks you to click on a link or open an attachment — do I have an account with the company or know the person who contacted me?” If the answer is no, it is a scam.

The card-number payoff

Not every phishing message is after money directly. Some are gathering login credentials, some deliver malware through the attachment, and some — the kind most relevant to your statement — are collecting card numbers and billing details under the cover of “account verification.”

Legitimate companies will not email or text you a link to update your payment information. The FTC is explicit about this: “While real companies might communicate with you by email, legitimate companies won’t email or text with a link to update your payment or account information.” Any message that does is phishing, by definition.

A card number submitted to a phishing page goes to the scammer within seconds and can be used or sold before the page is ever taken down. That is why the response to a suspicious payment link is not to click and check — it is to open the company’s real website or app separately and log in from there.

What to do if you replied

1. Do not click more links If the message had links or attachments, do not click anything else from it. The first click may already have installed tracking or malware.
2. Call the real company Use the phone number or website on the back of your card or from a statement — never the contact details in the phishing message — and report what you entered.
3. Watch for immediate fraud A freshly phished card is often used within days. Watch for small test charges and report them immediately.
4. Report the phishing attempt Forward suspicious emails to [email protected], forward texts to SPAM (7726), and report to the FTC at ReportFraud.ftc.gov.

Stopping the cycle

The defenses against phishing are habit-based, not technical. Two-factor authentication makes a stolen password far less useful. Strong spam filters catch a percentage before you ever see it. And the core reflex — never entering payment details from a link you did not request — blocks most of the rest.

The FTC’s guidance is that two or more credentials make it “harder for scammers to get into your account, even if they get your username and password,” and that a report at ReportFraud.ftc.gov helps law enforcement take the operations down. Phishing works because it feels routine; the counter is treating every unexpected request for card details as guilty until verified.