Protect yourself from phishing and fake websites

With phishing, a scammer pretends to be a different person or from an organization. They try to trick you into sharing personal or financial details. This may include credit card numbers, social security numbers, or passwords.

Be cautious of texts or emails asking for your personal, account, or credit card info. If you get such a request, report it to AT&T Internet Security at abuse@att.net. You can also forward the phishing email to the Anti-Phishing Working Group at reportphishing@antiphishing.org or report it to the Federal Trade Commission.

Recognizing phishing and fake websites

Scammers constantly change their attacks to include details that make you believe the scam is real.

It’s important you know what to look for if you aren't sure if a website or email is legitimate, check for these warning signs:

• Incorrect URL: If the site uses a different web address (URL) than your bank’s, it’s probably a fake site. Hover your mouse pointer over the link in the email to see if it’s directed to the same site the email came from.
• All caps in email subject lines: Scammers often use all capital letters in email subject lines to get your attention. We never use all capital letters in our subject lines, so this is a good sign the email is fake.
• Many undisclosed recipients: Scammers send thousands of phishing emails, hoping someone will bite. If you see an email copied to other recipients, watch out. We consider our customers as individuals, so your email is only sent to you.
• Banking information: A real bank won’t ask for your banking account info or debit card and PIN numbers through email. Be careful of emails or sites asking for sensitive details, including your Social Security number, besides the standard sign-in credentials.
• Confirm sensitive account info: If an email or website asks you to confirm sensitive account info, this is likely a scam.
• Public internet account: Before clicking on any link sent to you by email, look at the sender's email address. If the email has a non-business email address but claims to be from your bank or another business, don’t trust the email. All myAT&T emails are sent from att-mail.com. So, if you don't see that email address, we didn’t send it.
• Generic customer name: Make sure email claiming to be from your bank includes your given name in the message, such as Dear William Smith, instead of Dear Valued Customer. Real banks address messages to you by name.
• Misspelled words: Real companies have staff checking the accuracy of emails and websites. If you see a misspelling or a misuse of the company name, don't enter any personal info on the site.
• Not a secure site: Legitimate e-commerce sites use encryption, or scrambling, to make sure your payment info stays safe. If a site is using encryption, look for a lock symbol in the browser window. The lock symbol confirms it's a legitimate, trusted website. You can also see in the web browser that the website address starts with https:// rather than just http://. Don’t enter payment details on any site that isn't secure.
• Low-resolution images: Scammers usually create fake sites quickly. This shows in the quality of the sites. If the logo or text appears in poor resolution, it’s an important clue the site could be phony.