How to spot phishing emails before you click
How to spot phishing emails starts with slowing down: check the sender, the link destination, the request, the tone, the attachment, and whether the message matches a real account action you expected. Phishing emails often impersonate trusted brands, create urgency, and push you toward passwords, payments, verification codes, or fake login pages.
Phishing is built around urgency
A phishing email wants you moving before you think. It may say your account will close, a package is stuck, a payment failed, a refund is waiting, or your password must be verified today.
The story changes by brand, but the pressure stays familiar. You are asked to click, download, call, pay, or enter credentials. The message usually gives you just enough fear or reward to skip your normal caution.
The FTC consumer site warns about scams that impersonate trusted organizations and ask for money or personal information. That is the right mindset: a familiar logo does not make a message safe.
Check the sender, but do not trust it alone
Start with the sender name and email address. A message may show “Bank Support” while the actual address is a random domain, misspelled company name, or free email account.
Still, sender checks are not enough. Display names can be faked, compromised accounts can send real-looking messages, and some attackers use domains that look close to the real one. Treat the sender as one clue, not the whole answer.
If the email claims to be from a company you use, open the company’s app or type the address yourself. Do not log in through the button in the message.
| Clue | What to inspect | Safer response |
|---|---|---|
| Sender | Full email address and domain | Compare with known messages from the company |
| Link | Destination shown on hover or long press | Visit the site directly instead |
| Attachment | Unexpected invoice, form, or shared file | Confirm with the sender through another channel |
| Request | Password, code, payment, gift card, or personal data | Stop and verify independently |
| Tone | Urgent threat or too-good offer | Slow down before acting |
A familiar sender name can be faked on calls and texts too, so learn how to recognize whether you are being spoofed and what to do next.
Inspect links for look alike phishing websites
Look alike phishing websites are fake pages built to resemble a bank, delivery service, cloud account, payment app, employer portal, or government page. The page may copy the logo, colors, and login form while using a different domain.
On desktop, hover over the link before clicking. On mobile, long-press carefully without opening it if your device allows preview. Check the domain, not just the first words. A link can include a real brand name while sending you somewhere else.
If a message says there is a problem, go around the link. Open the app, type the official address, or use a saved bookmark. A real account issue should be visible after you sign in through a path you trust.
Read the URL, not the button text
Buttons are designed to make decisions feel simple. That is useful in a real account notice and dangerous in a fake one. The text on the button can say anything; the destination is what matters.
Watch for domains that add extra words before or after the brand, swap similar-looking letters, use odd endings, or hide the real destination behind a short link. A fake payment notice might use a domain that contains the brand name but is not controlled by that brand.
Subdomains can confuse people, too. In a real URL, the registered domain sits just before the ending such as .com, .org, or .gov. If the brand name appears earlier in a long string but the main domain belongs to someone else, do not sign in there.
Mobile screens make this harder because they show less of the address. If you cannot clearly see where a link goes, skip the link and open the app yourself.
Verify through a clean path
A clean path is a route the email did not give you. Open your bank app, type the shipping company’s address, use a saved bookmark, or call a number from the back of your card. That one habit defeats many phishing links.
Be especially careful with password resets and account-lock warnings. If the message is real, the alert should also appear after you sign in through the official site. If it does not, the email may have been bait.
For banks, payroll portals, and health accounts, use the contact information already saved in your account or printed on official documents. A phone number inside the suspicious email is part of the message you are trying to verify.
For job, rental, marketplace, or dating messages, the sender may be a person rather than a company. If a stranger’s email includes a name, number, or location, a people search can help compare public identity clues, and a reverse phone lookup can help when the same person pushes you to text or call.
Mobile email can make phishing harder to see
Phones hide details. The screen is smaller, sender addresses are truncated, and people often check mail while walking, waiting in line, or switching between tasks. That makes a rushed tap more likely.
Slow the message down before acting. Expand the sender details. Preview the link if your phone supports it. If the message involves money, account access, or a password reset, wait until you can review it on a larger screen or through the official app.
Be careful with QR codes in emails too. A QR code can send you to the same kind of fake page as a normal link, but the destination is harder to inspect before scanning.
Watch attachment and file tricks
Unexpected attachments deserve suspicion. A fake invoice, resume, shipping label, voicemail, tax form, or shared document can carry malware or send you to a credential-stealing page.
Do not open an attachment just because the subject line sounds routine. If the sender is someone you know, confirm through a separate channel before opening a file you did not expect. Their account may be compromised.
Be careful with file names that hide the real type. A document that asks you to enable macros, install a viewer, or sign in again before reading should be treated as a potential attack.
Phishing scams are illegal and should be reported
Phishing scams are illegal because they are designed to steal money, credentials, personal information, or access to accounts. Even if you did not lose money, reporting helps platforms and agencies see patterns.
Forward suspicious emails to the service being impersonated when that service provides a reporting address. Use your email provider’s phishing-report button. If money, identity theft, or fraud is involved, preserve screenshots and transaction details.
The Better Business Bureau can also help you review business names and complaint patterns when a message claims to come from a company you do not recognize.
How to report phishing emails
Knowing how to report phishing emails helps email providers, companies, and investigators connect related scams. Use your email app’s report-phishing or report-spam option first, then forward or submit the message where the impersonated company asks users to report abuse.
If money was stolen, an account was taken over, or the message is part of a broader internet crime, file with the FBI’s Internet Crime Complaint Center at IC3.gov. The FBI’s 2022 IC3 release reported phishing among major complaint categories and noted reported losses tied to phishing schemes, which is why reporting matters beyond your own inbox.
You can also check patterns at the BBB Scam Tracker when you want to see whether similar messages are circulating. Do not post private account numbers, full email headers with personal tokens, or sensitive documents in public reports.
Old scams still teach the pattern
Classic advance-fee emails promised an inheritance, business deal, or hidden fortune if the victim sent money first. The details now look dated, but the structure still appears in modern inboxes.
The sender offers a reward, refund, account fix, or urgent rescue. Then the email asks for payment, login credentials, identity documents, or a verification code. Once you comply, the promised benefit disappears.
The useful lesson is not that every scam has bad spelling. Many modern messages are polished. The warning is the trade: you must give money or access to receive something you did not request.
Common phishing setups you will see
The fake package message is one of the easiest to fall for because nearly everyone orders something. It says a delivery failed, a small fee is due, or an address must be confirmed. The link then asks for payment details or a login.
Bank and payment-app messages lean on fear. They mention suspicious activity, frozen transfers, or a pending charge. Instead of using the message, open the account yourself and check notifications there.
Workplace scams use authority. A message may pretend to be your boss, payroll department, help desk, or a vendor. If it asks for gift cards, wire transfers, password resets, or file access outside the usual process, verify through a separate channel.
Tax and government impersonation emails often sound official, but real agencies do not need you to enter sensitive information through a surprise link. The Federal Trade Commission’s scam guidance is a useful reference when you are comparing a message against common fraud patterns.
Common phishing types compared
| Attack Type | How It Arrives | What It Wants | Safer Response |
|---|---|---|---|
| Mass phishing | Generic email blast | Login credentials or payment details | Visit the official site manually. |
| Spear phishing | Personalized email or message | Access, money, internal data | Confirm through a separate trusted channel. |
| Smishing | Text message | Link clicks, account codes, payment | Do not use the link; check the account directly. |
| Vishing | Phone call or voicemail | Codes, card numbers, remote access | Hang up and call the published number. |
| Clone phishing | Copied legitimate-looking email | Attachment opens or credential entry | Compare sender, timing, and file details. |
| Fake login page | Link from email, text, or ad | Username, password, MFA code | Use bookmarks or the official app. |
Workplace phishing has different pressure
At work, phishing may impersonate a manager, payroll system, benefits portal, vendor, or shared document. The email may arrive during a busy period when quick action feels normal.
Watch for requests that change payment details, buy gift cards, update direct deposit, approve invoices, or open a shared file you were not expecting. A short confirmation through a known phone number or internal chat can prevent a costly mistake.
If your workplace has a report-phishing button or security mailbox, use it. Do not forward suspicious attachments to coworkers unless your security team asks you to. Forwarding can spread the risk.
Fake invoices and password resets deserve a second check
Two phishing themes deserve extra attention: money owed and account access. A fake invoice may look boring on purpose because people process routine bills quickly. A fake password reset may arrive when you are already worried about account security.
Check invoices against orders, contracts, and vendor records before paying. Check password resets by going directly to the account, not through the message. If you did not request the reset, change the password from the real site and review account activity.
When the message involves a business payment, a payroll change, or a personal account you use often, a thirty-second verification can prevent hours of cleanup.
Use lookup tools for suspicious contact details
If an email gives a phone number, name, or alternate contact, check it before responding. An email lookup can help you review public context around an unfamiliar address, while a people search can help when a name and story do not match.
Do not let a lookup replace common sense. A scammer can use a real person’s name or a compromised inbox. The safest move is still to verify through the company’s official site, app, or known phone number.
For what to do once one gets through, read how to report phishing in Gmail. Spotting one message is useful; building habits is better.
One of those habits is checking a strange address before you reply, and knowing what an email lookup can reveal keeps your expectations realistic while you search public profiles.
What to do if you clicked
If you clicked but did not enter anything, close the page and do not download files. If you entered a password, change it from the real site immediately. If you reused that password elsewhere, change those accounts too.
If you entered a payment card, bank login, Social Security number, or one-time code, contact the affected institution quickly. Check account activity and enable two-factor authentication where possible.
If malware may have been installed, disconnect from the network if needed and run trusted security tools. Do not keep using a device you think is compromised for banking or email recovery. Write down what happened while the timeline is still clear, including the sender, link, file, account affected, and any password entered during the incident.
Protect recovery channels first
Your email account is often the reset key for everything else. If a phishing message steals your email password, the attacker may try banking, shopping, cloud storage, tax, and social accounts next.
Change the email password first if you think it was exposed. Then review forwarding rules, recovery phone numbers, connected apps, and logged-in devices. Attackers sometimes leave a back door so they can return after you change the password.
After that, protect high-value accounts. Start with banking, payment apps, tax accounts, cloud storage, and any account that holds identity documents or private photos.
Use account protections that reduce the damage
Good habits matter, but accounts also need guardrails. Use unique passwords, store them in a password manager, and turn on two-factor authentication for email, banking, cloud storage, and payment apps.
Authentication apps or hardware security keys are stronger than text-message codes, but any second factor is usually better than a password alone. Never share a one-time code with someone who contacted you, even if they claim to be support.
Keep devices updated so known security holes get patched. Phishing often starts with a message, but the damage can spread through old software, reused passwords, and accounts that never ask for a second proof.
Build a thirty-second email routine
Pause before clicking. Ask: did I expect this message, does the sender match, does the link go where it should, and what happens if I ignore this for ten minutes?
Most legitimate account problems can survive a short delay. A scammer’s advantage is momentum. Breaking that momentum is often enough to prevent the mistake.
Use bookmarks for important accounts, keep software updated, and turn on multi-factor authentication. Those habits reduce the damage if one message slips through.
Frequently Asked Questions
how to spot a phishing email
Check the sender address, link destination, request, attachment, and urgency. Be suspicious of messages asking for passwords, verification codes, payments, gift cards, or personal documents. Instead of clicking the message link, open the real app or website directly and confirm there.
how to spot phishing emails
Look for mismatched domains, unexpected attachments, urgent threats, fake refunds, account-lock warnings, and requests for sensitive information. A polished design does not prove the email is real. Verify through a trusted route before entering credentials, sending money, or opening files.
How to avoid phishing emails?
Use your email provider’s spam and phishing-report tools, preview links before opening them, and be cautious with unexpected attachments. If an email claims a serious account problem, leave the message and sign in through the official website or app to check.
How to avoid phishing attacks?
Combine habits with technical protections: password manager, unique passwords, two-factor authentication, software updates, and careful reporting. For workplaces, confirm payment or credential requests through approved channels, especially when a message claims to come from an executive, vendor, or help desk.
how to spot phishing emails training
Training should teach people to slow down, inspect links, recognize impersonation, and report suspicious messages. Use realistic examples from banks, delivery services, employers, cloud accounts, and payment apps. The goal is not memorizing every scam; it is building a repeatable checking habit.
how to spot a phishing email 2019
Older advice still helps, but phishing has become more polished. Do not rely only on bad grammar or strange formatting. In any year, the safer test is the same: verify the sender, avoid unexpected links, inspect attachments, and use the real website or app.
