Phishing is the most reported type of cyber scam in the United States and worldwide, and these attacks continue to rise and evolve every day. In 2024, the Better Business Bureau established National Scam Survivor Day, observed on the second Thursday in May. Throughout the month, the BBB, FBI, and National Cybersecurity Alliance lead awareness campaigns focused on common scams and prevention strategies. As phishing scams grow more sophisticated, retirees and high-net-worth (HNW) individuals must stay vigilant because even the most careful investors can fall victim to scams that result in significant financial loss and disruption.
Phishing 101: The basics
Phishing gets its name from the idea that attackers are “fishing” for victims by using spoofed or fraudulent messaging as bait. It’s a type of online scam where someone pretends to be a trusted source to trick you into sharing your personal details, login credentials, or payment information. These attacks can come through email, text, phone calls, or anywhere online and can result in identity theft, hacked accounts, and lost funds.
Common types of phishing attacks
- Email phishing (Mass-market impersonation): The most common form of phishing. Attackers send fraudulent emails that appear to come from government agencies or other legitimate entities, urging recipients to click on links, open attachments, or provide sensitive information. For example, scammers have recently impersonated the IRS during tax season, sending emails claiming an issue with a taxpayer’s return or refund. Corporations and their employees in various industries are also being targeted. Regulators have recently issued warnings about an “agent phishing” scam in which attackers have pretended to be the National Insurance Producer Registry (NIPR), sending fake past-due invoice emails to insurance agents, applicants, and administrators.
- Spear phishing (Targeting): Attackers specifically target high-value victims and organizations using specific or personalized information to make the attack appear legitimate. This is highly effective because attackers tailor messages to the recipient, such as referencing a conference or recent event the recipient may have just attended or using filenames tied to topics of interest.
- Vishing (Voice phishing): Scammers use phone calls to impersonate legitimate individuals or organizations, often claiming urgent issues to pressure victims into providing sensitive information. Recent attacks increasingly use AI-generated voices to mimic real people and sound more convincing.
- Smishing (SMS/text phishing): Similar to email phishing but conducted through text messages. If your phone number has been exposed after a data breach, you may find yourself on the receiving end of more smishing attacks. USPS scam texts are a common example, where fake delivery or purchase notifications urge you to tap a link to confirm or resolve an issue.
- And other tactics: Fake public Wi-Fi networks, lookalike website domains, pop-up internet ads, and various other methods.
Hook, line, and sinker: Red flags to watch for
Phishing emails and messages often rely on familiar names and urgent language to prompt quick action. Be cautious of emails or messages that appear to come from well-known, trusted organizations like LinkedIn, Amazon, or the IRS.
- Always look closely for misspellings or added/substituted characters in the sender address. Legitimate companies use official domains, for example Amazon emails will come from an address ending only in “@amazon.com,” not “@amazon-support.com” or other variations.
- The IRS, SSA, and other official U.S. government agencies will never initiate contact through email, text, or social media.
- Watch for generic or suspicious subject lines, such as “Mail Notification: You have 5 Encrypted Messages,” “Undelivered Mail Returned to Sender,” or “Action required: Your payment was declined.”
Other common red flags can include:
- Poor grammar, generic greetings, unexpected prizes and offers, and requests for personal information.
- Urgent threats such as account suspension or limited-time demands to act.
- Subtle changes like “rn” instead of “m” in links and URLs.
- Unusual attachments or file names from unknown senders.
- Poorly formatted emails, broken links, multiple fonts, or colors and logos that don’t match the company’s official branding.
Additionally, the Department of Social Security Administration (SSA) has identified four key warning signs to help recognize and avoid scams, known as the four Ps:
- Pretend: Scammers pretend to be a trusted source
- Problem: Scammers will fabricate an issue to intimidate recipients
- Pressure: Scammers will pressure recipients to act immediately
- Pay: Scammers will request payment in specific ways such as through gift cards, online transfers, or money orders.
How to protect yourself
- Think before you click: If you receive a suspicious invoice or request from an email claiming to be from USPS, FedEx, Amazon, or another organization, do not open any attachments, click any links, or submit payment. Instead, verify the legitimacy by contacting the organization directly using an official email address, phone number, or secure message center.
- Use strong, unique passwords: Passwords should be long, complex, and never based on birthdays, pet names, or other personal details. Shoot for 16 characters or more, including a mix of letters, numbers, and special characters.
- Multi-factor authentication (2FA): More sites and apps now offer two-factor authentication, adding an extra layer of security beyond a username and password. By requiring multiple forms of verification, it makes it much harder for cybercriminals to gain access to your account.
- Antivirus security software: Install reputable antivirus security software, and keep software and devices updated automatically, to detect and thwart phishing campaigns in real time. Forbes lists Norton, TotalAV, Avast, Aura, and McAfee among top-rated security software options for 2026.
You’ve worked hard to build and preserve your financial security. Don’t let it be compromised by a moment of uncertainty. Always verify before responding. If something doesn’t look right, trust your instincts!
As licensed financial professionals, we are committed to helping you protect and preserve your wealth in every way we can. If you ever receive a suspicious message, our team is here as a resource to provide a second opinion before you take action. Bulwark Capital Management can help you stay on track, adjust as needed, and support you in making steady progress toward your financial future.
Sources:
- https://www.fbi.gov/how-we-can-help-you/scams-and-safety
- https://victimsofcrime.org/event/scam-survivor-day/
- https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams
- https://www.statista.com/topics/8385/phishing/#topicOverview
- https://www.consumerfraudreporting.org/current_top_10_scam_list.php
- https://www.newsminimalist.com/articles/interpol-online-scams-phishing-are-top-global-cybercrimes-b001f2d2
- https://lifelock.norton.com/learn/fraud/types-of-phishing
- https://www.csoonline.com/article/563353/8-types-of-phishing-attacks-and-how-to-identify-them.html
- https://www.kaia.com/2025/06/02/phishing-scam-targeting-agents-be-aware/
- https://department.va.gov/privacy/fact-sheet/the-four-ps-of-spotting-fraud/
- https://www.amazon.com/gp/help/customer/display.html?nodeId=Teu845SZK0ApsIgmGC
DISCLOSURE
Investment Advisory Services offered through Trek Financial LLC, an investment adviser registered with the Securities Exchange Commission. Information presented is for educational purposes only. It should not be considered specific investment advice, does not take into consideration your specific situation, and does not intend to make an offer or solicitation for the sale or purchase of any securities or investment strategies. Investments involve risk and are not guaranteed, and past performance is no guarantee of future results. For specific tax advice on any strategy, consult with a qualified tax professional before implementing any strategy discussed herein. The content is developed from sources believed to be providing accurate information; no warranty, expressed or implied, is made regarding accuracy, adequacy, completeness, legality, reliability, or usefulness of any information. Consult your financial professional before making any investment decision. Trek 26-108
Instead of scrambling to search for restaurants or attractions right after you arrive in a new city, save everything in advance on Google Maps while planning your trip. You can create lists like “Hawaii 2026,” “Summer Vacation,” or “Greece” to help you remember what each location is for. You can even take it a step further and create custom lists for each day of your trip for those of you who are Type A travelers.
International data charges add up fast. For example, plans like AT&T’s International Day Pass or Verizon’s TravelPass can cost around $12 per day, which becomes expensive on longer trips. Even in popular cities or crowded tourist areas like New York City or Chicago, cellular service can be unreliable due to network congestion and tall buildings that interfere with signal strength.
Packing cubes are one of the simplest “upgrades” you can make when planning your trip. They help save space, keep outfits organized, and prevent overpacking. Instead of digging through your entire suitcase, everything has its place, and you can organize your cubes however you prefer—by outfit, clothing type, or weather.
Pharmacies abroad can be confusing, with different brands, languages, and sometimes limited hours. It’s best to save yourself from the headache (and the pain reliever you will need to help fix it!) by bringing small quantities of medications with you.
253.799.6416
invest@bulwarkcapitalmgmt.com