How to Spot a Phishing Email

Phishing emails are designed to make you act before you have time to question what you’re seeing. They might imitate your bank, employer, delivery company, streaming service, or even someone you know. Some are obvious, but modern phishing attempts can look remarkably professional. Logos, formatting, signatures, and convincing language are easy to copy, which means spotting phishing is less about finding one obvious mistake and more about recognizing a combination of warning signs.

Check who actually sent the email

The display name at the top of an email isn’t enough to prove who sent it. A message might appear to come from “Customer Support” or a familiar company while the actual email address belongs to an unrelated domain. Before clicking anything, look closely at the complete sender address. Watch for misspellings, extra letters, unusual domains, or substitutions designed to resemble the legitimate address. An attacker might use a domain that differs from the real one by only a character or two. Context matters as well. If your colleague normally contacts you through a company email address but suddenly sends a financial request from an unfamiliar personal account, verify it another way. Don’t assume an email is legitimate simply because it includes the correct name, company logo, or personal information about you. Some of that information may already be publicly available or may have appeared in previous data breaches. When a request seems unusual, contact the person or organization through a phone number, website, or communication channel you already trust rather than replying directly to the suspicious message.

Be suspicious of urgency and unusual requests

Phishing often works by creating pressure. The email might claim your account will be suspended within hours, a payment has failed, someone has logged into your account, or you must immediately verify personal information. Other messages create excitement instead, telling you that you’ve received a refund, prize, unexpected payment, or important document. The subject changes, but the strategy is similar: create a strong emotional reaction that encourages you to click before thinking. Pay particular attention when an email asks you to enter a password, provide banking details, buy gift cards, transfer money, download an unexpected file, or send sensitive information. Workplace phishing can be especially convincing because attackers may impersonate executives or colleagues and ask for something that sounds almost normal. A message supposedly from your manager saying, “I’m in a meeting—can you urgently purchase these gift cards for a client?” should immediately justify independent verification. Legitimate organizations sometimes send urgent messages too, so urgency alone doesn’t prove an email is fraudulent. It simply means you should slow down and verify the request independently.

Inspect links and attachments before opening them

A link can display one destination while actually sending you somewhere completely different. Before clicking, inspect where the link really leads. On a computer, hovering over a link will often reveal its destination. On mobile devices, pressing and holding a link may allow you to preview it without opening the page, depending on the device and app. Look carefully at the actual domain rather than simply searching the address for a familiar company name. A phishing URL might include a legitimate brand name somewhere in a much longer address while the real domain belongs to someone else. If an email tells you there is a problem with an important account, the safer option is often to avoid the email link entirely. Open the company’s official app or manually navigate to the website you normally use and check the account there. Unexpected attachments deserve similar caution, particularly when the message pressures you to open them immediately. Even familiar file types can be used as part of malicious campaigns. If you weren’t expecting the document, confirm with the sender through another trusted channel before opening it.

Look at the whole message, not one clue

People are often told that spelling mistakes are the easiest way to identify phishing. Poor grammar can certainly be a warning sign, but it isn’t a reliable test anymore. A sophisticated phishing email can be perfectly written, professionally formatted, personalized with your name, and visually almost identical to a legitimate company message. Instead, consider the complete situation. Were you expecting the email? Does the sender address make sense? Is the request normal? Is the message trying to create urgency? Does the link lead where you expect? Is it requesting information the organization would normally already have? When several small warning signs appear together, treat the message cautiously. If you’ve already clicked a suspicious link but haven’t entered information, close the page and avoid further interaction. If you entered a password, change it immediately through the legitimate service, and change it anywhere else you reused it. Enable multi-factor authentication where possible and review the account for unfamiliar activity. Ultimately, the most useful phishing habit is simple: when an unexpected email asks you to click, download, pay, log in, or share sensitive information, verify the request independently before doing anything.