The most dangerous message you’ll get this weekend won’t look dangerous at all. It will look like a routine email or text — from your bank, a delivery service, a city agency, even a “friend” — asking you to confirm a detail, verify your account, or open an attachment. This is phishing, and it is the single most common way New Yorkers get scammed. Here is how to spot it, the one rule that catches most fakes, and exactly how to report it.
Who This Helps
This guide is for every New Yorker with a phone or an inbox — but especially for older adults, who are being targeted at rising rates, and for anyone who has ever paused over a text and thought, “Wait, is this real?” If you have that instinct, trust it. This article tells you what to do next.
The Core Trick: Urgency and “Verification”
Phishing works by manufacturing urgency. The message claims something is wrong — a suspicious charge, a package held at customs, a complaint filed against you, an account about to be suspended — and pushes you to act right now by clicking a link, opening an attachment, or “confirming” your information. The whole scheme depends on you reacting before you think.
The NYC Department of Consumer and Worker Protection (DCWP) is direct about this: do not respond to unsolicited emails requesting personal information, and be especially wary of any message asking you to “verify your information” or “confirm your user ID and password.” Legitimate institutions do not ask you to hand over passwords by email or text.
The One Rule That Catches Most Fakes: Check the Real Address
Scammers “spoof” sender names so a message appears to come from someone you trust. The defense is to look past the display name at the actual email address or link destination. DCWP’s own example is instructive: when a fake email circulated pretending to be from the city’s consumer agency, the tell was the address — anything not ending in the agency’s official “@dca.nyc.gov” domain was a scam and should be deleted immediately. Apply the same logic everywhere: a “bank” emailing from a Gmail or Outlook address is not your bank.
On a phone, do not tap the link. Instead, open a page you trust by typing the company’s real URL yourself or using a bookmark you set previously — never the link in the message.
How to Take Action — Protect Yourself This Weekend
Per DCWP’s phishing best practices, build these habits in:
- Never click links or open attachments in suspicious emails — even ones that appear to be from friends or trusted sources, since their accounts may be compromised or spoofed.
- Verify by phone. If a message claims to be from a person or company you know, contact them through a number you already have — not the contact info in the message — and ask if they really sent it.
- Never give out personal info in response to an unsolicited request, and tighten privacy settings on social media so scammers have less to work with.
- Open web pages from your own bookmarks or by typing the URL, rather than following emailed links.
- Do not respond to unsolicited pop-ups or chain messages, and do not forward suspected phishing to others.
How to Report a Scam or Phishing Attempt
Reporting helps the city track patterns and warn others. Here is where to send it:
- File a consumer complaint with DCWP: go to nyc.gov/dcwp or call 311.
- Report phishing to the Federal Trade Commission: DCWP directs New Yorkers to the FTC’s consumer site at consumer.ftc.gov for reporting instructions.
- Forward suspicious texts to 7726 (SPAM), a free service most carriers support to flag scam messages.
- If money was already lost or you feel threatened, contact the NYPD by calling 911 for an emergency in progress, or 311 to be routed to the right unit for a report.
A Quick Word for Anyone Helping an Older Relative
Fraud against older New Yorkers is a growing problem, and the most effective protection is a simple family rule: before acting on any message about money, accounts, or “verification,” call me first. Scammers count on isolation and urgency. A single phone call to a trusted person breaks both. Save 311 in their phone, and consider walking through the “check the real sender address” trick together this weekend.
The Bottom Line
Phishing is not sophisticated — it just moves fast and counts on you moving faster. Slow down. Check the real sender. Never click, never confirm a password, and verify through a number you already trust. If something feels off, it almost certainly is. Report it to DCWP at nyc.gov/dcwp or 311, and you’ll help protect the next New Yorker too. We’re here to help you navigate this.
This article provides general consumer-safety information. If you are the victim of a crime or in immediate danger, call 911.
