How to spot phishing emails before you click
How to spot phishing emails starts with slowing down: check the sender, the link destination, the request, the tone, the attachment, and whether the message matches a real account action you expected. Phishing emails often impersonate trusted brands, create urgency, and push you toward passwords, payments, verification codes, or fake login pages.
Phishing is built around urgency
A phishing email wants you moving before you think. It may say your account will close, a package is stuck, a payment failed, a refund is waiting, or your password must be verified today.
The story changes by brand, but the pressure stays familiar. You are asked to click, download, call, pay, or enter credentials. The message usually gives you just enough fear or reward to skip your normal caution.
The FTC consumer site warns about scams that impersonate trusted organizations and ask for money or personal information. That is the right mindset: a familiar logo does not make a message safe.
Check the sender, but do not trust it alone
Start with the sender name and email address. A message may show “Bank Support” while the actual address is a random domain, misspelled company name, or free email account.
Still, sender checks are not enough. Display names can be faked, compromised accounts can send real-looking messages, and some attackers use domains that look close to the real one. Treat the sender as one clue, not the whole answer.
If the email claims to be from a company you use, open the company’s app or type the address yourself. Do not log in through the button in the message.
| Clue | What to inspect | Safer response |
|---|---|---|
| Sender | Full email address and domain | Compare with known messages from the company |
| Link | Destination shown on hover or long press | Visit the site directly instead |
| Attachment | Unexpected invoice, form, or shared file | Confirm with the sender through another channel |
| Request | Password, code, payment, gift card, or personal data | Stop and verify independently |
| Tone | Urgent threat or too-good offer | Slow down before acting |
Inspect links for look alike phishing websites
Look alike phishing websites are fake pages built to resemble a bank, delivery service, cloud account, payment app, employer portal, or government page. The page may copy the logo, colors, and login form while using a different domain.
On desktop, hover over the link before clicking. On mobile, long-press carefully without opening it if your device allows preview. Check the domain, not just the first words. A link can include a real brand name while sending you somewhere else.
If a message says there is a problem, go around the link. Open the app, type the official address, or use a saved bookmark. A real account issue should be visible after you sign in through a path you trust.
Mobile email can make phishing harder to see
Phones hide details. The screen is smaller, sender addresses are truncated, and people often check mail while walking, waiting in line, or switching between tasks. That makes a rushed tap more likely.
Slow the message down before acting. Expand the sender details. Preview the link if your phone supports it. If the message involves money, account access, or a password reset, wait until you can review it on a larger screen or through the official app.
Be careful with QR codes in emails too. A QR code can send you to the same kind of fake page as a normal link, but the destination is harder to inspect before scanning.
Watch attachment and file tricks
Unexpected attachments deserve suspicion. A fake invoice, resume, shipping label, voicemail, tax form, or shared document can carry malware or send you to a credential-stealing page.
Do not open an attachment just because the subject line sounds routine. If the sender is someone you know, confirm through a separate channel before opening a file you did not expect. Their account may be compromised.
Be careful with file names that hide the real type. A document that asks you to enable macros, install a viewer, or sign in again before reading should be treated as a potential attack.
Phishing scams are illegal and should be reported
Phishing scams are illegal because they are designed to steal money, credentials, personal information, or access to accounts. Even if you did not lose money, reporting helps platforms and agencies see patterns.
Forward suspicious emails to the service being impersonated when that service provides a reporting address. Use your email provider’s phishing-report button. If money, identity theft, or fraud is involved, preserve screenshots and transaction details.
The Better Business Bureau can also help you review business names and complaint patterns when a message claims to come from a company you do not recognize.
Old scams still teach the pattern
Classic advance-fee emails promised an inheritance, business deal, or hidden fortune if the victim sent money first. The details now look dated, but the structure still appears in modern inboxes.
The sender offers a reward, refund, account fix, or urgent rescue. Then the email asks for payment, login credentials, identity documents, or a verification code. Once you comply, the promised benefit disappears.
The useful lesson is not that every scam has bad spelling. Many modern messages are polished. The warning is the trade: you must give money or access to receive something you did not request.
Workplace phishing has different pressure
At work, phishing may impersonate a manager, payroll system, benefits portal, vendor, or shared document. The email may arrive during a busy period when quick action feels normal.
Watch for requests that change payment details, buy gift cards, update direct deposit, approve invoices, or open a shared file you were not expecting. A short confirmation through a known phone number or internal chat can prevent a costly mistake.
If your workplace has a report-phishing button or security mailbox, use it. Do not forward suspicious attachments to coworkers unless your security team asks you to. Forwarding can spread the risk.
Fake invoices and password resets deserve a second check
Two phishing themes deserve extra attention: money owed and account access. A fake invoice may look boring on purpose because people process routine bills quickly. A fake password reset may arrive when you are already worried about account security.
Check invoices against orders, contracts, and vendor records before paying. Check password resets by going directly to the account, not through the message. If you did not request the reset, change the password from the real site and review account activity.
When the message involves a business payment, a payroll change, or a personal account you use often, a thirty-second verification can prevent hours of cleanup.
Use lookup tools for suspicious contact details
If an email gives a phone number, name, or alternate contact, check it before responding. An email lookup can help you review public context around an unfamiliar address, while a people search can help when a name and story do not match.
Do not let a lookup replace common sense. A scammer can use a real person’s name or a compromised inbox. The safest move is still to verify through the company’s official site, app, or known phone number.
For more prevention steps, read how to avoid phishing emails. Spotting one message is useful; building habits is better.
What to do if you clicked
If you clicked but did not enter anything, close the page and do not download files. If you entered a password, change it from the real site immediately. If you reused that password elsewhere, change those accounts too.
If you entered a payment card, bank login, Social Security number, or one-time code, contact the affected institution quickly. Check account activity and enable two-factor authentication where possible.
If malware may have been installed, disconnect from the network if needed and run trusted security tools. Do not keep using a device you think is compromised for banking or email recovery. Write down what happened while the timeline is still clear, including the sender, link, file, account affected, and any password entered during the incident.
Protect recovery channels first
Your email account is often the reset key for everything else. If a phishing message steals your email password, the attacker may try banking, shopping, cloud storage, tax, and social accounts next.
Change the email password first if you think it was exposed. Then review forwarding rules, recovery phone numbers, connected apps, and logged-in devices. Attackers sometimes leave a back door so they can return after you change the password.
After that, protect high-value accounts. Start with banking, payment apps, tax accounts, cloud storage, and any account that holds identity documents or private photos.
Build a thirty-second email routine
Pause before clicking. Ask: did I expect this message, does the sender match, does the link go where it should, and what happens if I ignore this for ten minutes?
Most legitimate account problems can survive a short delay. A scammer’s advantage is momentum. Breaking that momentum is often enough to prevent the mistake.
Use bookmarks for important accounts, keep software updated, and turn on multi-factor authentication. Those habits reduce the damage if one message slips through.
Frequently Asked Questions
how to spot a phishing email
Check the sender address, link destination, request, attachment, and urgency. Be suspicious of messages asking for passwords, verification codes, payments, gift cards, or personal documents. Instead of clicking the message link, open the real app or website directly and confirm there.
how to spot phishing emails
Look for mismatched domains, unexpected attachments, urgent threats, fake refunds, account-lock warnings, and requests for sensitive information. A polished design does not prove the email is real. Verify through a trusted route before entering credentials, sending money, or opening files.
how to spot phishing emails training
Training should teach people to slow down, inspect links, recognize impersonation, and report suspicious messages. Use realistic examples from banks, delivery services, employers, cloud accounts, and payment apps. The goal is not memorizing every scam; it is building a repeatable checking habit.
how to spot a phishing email 2019
Older advice still helps, but phishing has become more polished. Do not rely only on bad grammar or strange formatting. In any year, the safer test is the same: verify the sender, avoid unexpected links, inspect attachments, and use the real website or app.
