How to Identify Phishing Emails

Every inbox contains a few liars. Learning how to identify phishing emails is the skill of spotting them before they cost you money, accounts or a very stressful weekend. A phishing email pretends to be a bank, a delivery company, a colleague or a service you trust, and its whole job is to rush you into clicking a link, opening an attachment or handing over a password. The good news is that these messages almost always leave clues. You do not need to be a security expert to find them. You need a slower first thirty seconds, and a checklist you trust more than your first impression.

This guide teaches exactly that, in plain language and in a practical order. First you will learn what phishing is and why it works so well on busy, normal people. Then comes a red-flag checklist with explained, invented examples, a step-by-step routine you can use on any suspicious message, and a calm action plan for the moment everyone dreads: realising you already clicked. Read it once properly, and checking an email will start to feel like checking a parachute — a little slower, and completely worth it.

This article is part of our Cybersecurity & Internet series. It pairs naturally with our guide to the best password managers, because a manager makes a stolen password far less useful, and with our honest look at VPN benefits and risks, because understanding what each tool can and cannot do is the real heart of staying safe online.

What Phishing Actually Is, in Plain English

Phishing is fraud by impersonation, delivered by message. The attacker copies the look of a company or person you trust, writes something that demands a quick reaction, and points you to a fake website or a harmful attachment. If you type your password on that fake page, the attacker receives it and logs into the real service as you. If you open the attachment, malicious software may install itself quietly. If you reply with personal details, those details get used for identity fraud or to make the next message even more convincing.

The name is a joke about fishing: thousands of baited hooks go out, and the attacker only needs a small percentage to bite. That is why spelling is sometimes sloppy and stories sometimes absurd. The sender is not trying to fool everyone. They are trying to fool the tired, the rushed and the worried, on the one afternoon those people are not paying attention. Understanding that changes how you read your inbox. The question is never “does this look professional?” The better question is “what is this message trying to make me do, and how quickly?” That mindset sits alongside the wider habits in our guide to how to protect your online privacy, because less exposed personal information means less material for a convincing fake.

Regulators describe the same pattern. The United States Federal Trade Commission explains the common lures and the safest responses in its guidance on how to recognise and avoid phishing scams, and its central advice matches this article: do not click, do not reply, and contact the real organisation through a route you find yourself. When advice from your bank, your government and your favourite tech blog all agree, it is worth treating as settled.

Why Phishing Works on Smart People

It helps to drop the idea that victims are careless. Phishing works because it attacks emotions and routines, not intelligence. Urgency is the favourite lever: an account closing, a payment failing, a parcel expiring, a security alert demanding action today. Fear narrows attention, and narrowed attention stops checking details. Authority is the second lever. A message dressed as a tax office, a bank or your own manager borrows their authority, and most of us were raised to respond promptly to all three.

Context is the third lever, and it is getting stronger. Attackers scrape public profiles, breach data and social posts, then tailor messages: a real project name, a real colleague, a delivery you genuinely expect. That targeted version is often called spear phishing, and it can look flawless at a glance. The defence is not sharper eyes. The defence is a routine that does not depend on how the message looks, because routines still work when you are tired, distracted or halfway through cooking dinner.

How to Identify Phishing Emails: The Red-Flag Checklist

Here is the quick version first. Print it, screenshot it, or tape it near the family computer. Any single flag deserves a pause. Two or more together mean you should treat the message as hostile until you have verified it through a separate route.

• Unexpected urgency: act now, expires today, account closing within hours.
• A sender address that nearly matches: one letter swapped, an extra word, or a public webmail address.
• A generic greeting: “Dear customer” from a company that normally uses your name.
• A link whose real destination differs from the text you see.
• An unexpected attachment, especially invoices, forms or anything asking you to enable content.
• A request for secrets: passwords, card numbers, one-time codes or full personal details.
• Threats or unusual kindness: fines and legal trouble, or a prize and a refund you never expected.
• Odd tone, spelling or formatting for an organisation that is normally polished.
• A request to move the conversation to text messages, gift cards or an unusual payment method.
• Something that does not fit your life: a bank you do not use, a delivery you did not order, a meeting you never arranged.

Now let us slow down and look at the most important flags properly, because recognising them in real messages is a skill of detail. Every example below is invented for this guide, in general terms, so you can learn the pattern without memorising any real scam.

Red Flag 1: The Sender Address Is Nearly Right

Imagine a message from your streaming service, displayed with the correct logo and a friendly name. Tap or hover to reveal the full address, though, and it comes from a domain like support at stream-service-help dot example, or from a free webmail account. Real companies send from their own domain, consistently. A swapped letter, an added word like secure or verify, or a completely unrelated domain is the single most reliable clue in this whole article, because it is the one thing the attacker cannot fully fake in a normal inbox.

Red Flag 2: Urgency That Skips Normal Process

Picture an invented warning: your cloud storage will be deleted tonight unless you confirm your details immediately. Real services warn repeatedly, over weeks, through several channels, and deleting your files is bad business for them. Attackers compress time because time is their enemy. Every minute you pause is a minute in which you might check properly. Whenever a message tries to make you faster, deliberately become slower. That one habit defeats a surprising share of all phishing, all by itself.

Red Flag 3: The Link Destination Does Not Match

On a computer, hover your mouse over a link without clicking, and the real destination appears in a corner of the window or in a small preview. On a phone, press and hold carefully to preview it. An invented example: the visible text says your bank’s name, but the destination is a jumble of words, numbers and a country domain you have never seen attached to that bank. Subdomains are used to confuse, with the trusted name placed at the front of a long address that actually belongs to someone else. Read addresses from the right-hand meaningful part, and when in doubt, do not use the link at all. Open the official app or type the address you already know.

Red Flag 4: It Asks for Secrets a Real Company Would Not Request

Your bank already has your account number. Your email provider never needs your password sent back by email. No honest organisation asks for a full card number, a PIN or a one-time sign-in code through a message link. A request for any of those is not a small clue; it is the whole game revealed. The same applies to remote-access requests, where a supposed support agent asks you to install software so they can fix a problem you did not report. Hang up on the message version of that person, every time.

Red Flag 5: Attachments You Did Not Expect

An invented classic arrives daily in offices everywhere: an invoice from a supplier nobody recognises, a shipping document for an order nobody placed, or a form you are told to complete and return. Attachments can carry malicious software, and documents that ask you to enable editing or macros deserve special suspicion. If the attachment matters, it will survive verification. Contact the supposed sender through a number or address you already have, and ask one simple question: did you send me this? Thirty seconds of mild awkwardness beats a week of incident recovery.

Red Flag 6: The Story Does Not Fit Your Life

Sometimes the clue is pure context. A refund from a shop in another country, a court notice from a place you have never lived, a parcel held by a courier when nothing is on order. Attackers send millions of messages because a percentage will accidentally fit somebody’s week. When a message does coincidentally fit — you really are waiting for a parcel — the other flags matter more, not less. Use the courier’s official app, which already knows about your delivery, instead of the message that claims to.

Three Invented Phishing Examples, Decoded

Patterns stick better with stories, so here are three invented scenarios in general terms. None of this text is copied from a real message; each is a composite of the patterns described above.

The parcel that was never sent. A message says a delivery failed and a small redelivery fee is needed within a day, linking to a tidy page that asks for card details. The flags: you ordered nothing this week, the sender domain is a stranger, the fee is small enough to feel harmless, and the deadline is doing the persuading. The decode: the small fee is not the prize. Your card details are. The correct move is to check the courier’s real app or website, see no parcel, and delete the message with a small sense of satisfaction.

The manager who needs gift cards. A message that appears to come from your boss asks you to quietly buy gift cards for a client surprise and send the codes, urgently, without telling anyone. The flags: secrecy, urgency, an unusual payment method and a request that skips every normal purchasing process your workplace has. The decode: the display name is easy to copy; the real sender address is a free webmail account. The correct move is to contact your manager on a channel you already use and ask, in person if possible. Real managers survive being asked. Fraudsters do not.

The security alert that creates the danger. A message warns that someone signed into your account from another country and offers a button to secure it now. The flags: fear as the headline, a button instead of instructions to open the official app, and a destination address that only resembles the real one. The decode: if the alert were real, opening the official app yourself would show the same warning, in a place the attacker cannot fake. So do exactly that. If the app is calm, the email was the attack.

A Step-by-Step Routine to Check Any Suspicious Email

Skills fade; routines hold. Use these steps in order whenever a message asks you to click, open, pay, reply or download. The whole routine takes about a minute once it becomes habit, and it works for text messages and social media messages too, not just email.

1. Stop and breathe. Notice the emotion the message created. Urgency, fear and excitement are themselves evidence.
2. Read the full sender address, not the display name. Compare it with previous genuine messages from that organisation.
3. Inspect the greeting and story. Generic greetings and stories that do not fit your life lower your trust further.
4. Preview every link by hovering or long-pressing, and compare the destination with the real domain you know.
5. Refuse secret requests outright. Passwords, codes and full card details are never legitimately requested this way.
6. Question attachments and do not open unexpected ones, however professional they look.
7. Verify through a separate route. Open the official app, type the known website address yourself, or call a number printed on a card or statement.
8. Use your tools. The free helpers on our tools page include a password generator for the reset you are about to do properly, on the real site, if the account genuinely needs one.
9. Report the message using your mail app’s phishing or junk reporting option, which helps providers block the next wave.
10. Delete it and move on, and tell anyone whose name was used, through a separate channel, that a fake is circulating.

If you want to practise in a safe place, Google’s safety site at Google Safety Center offers learning material and a well-known phishing quiz that lets you test your eye on harmless examples. Practising on fakes that cannot hurt you is exactly how pilots train: in a simulator, before the weather turns. Ten minutes there will sharpen the routine above more than a month of good intentions.

Already Clicked? What to Do in the Next Hour

First, a necessary kindness: this happens to careful people every day, and shame only helps the attacker by slowing you down. What matters is the order of your next few actions. Work through this plan calmly.

1. Disconnect if you opened an attachment or installed anything. Switch off Wi-Fi or unplug the network cable to limit any malicious software’s ability to communicate, and note what you clicked and when.
2. Change the password from a different, clean device if you typed one into a fake page. Change the account involved first, then any account that shared that password — which is the strongest argument you will ever meet for using unique passwords everywhere.
3. Turn on two-factor authentication while you are there. Our upcoming guide on two-factor authentication explained walks through it step by step, and enabling it now can lock an attacker out even if they captured your password minutes ago.
4. Check the account for changes: recovery email addresses, phone numbers, forwarding rules, new payees, recent orders. Attackers quietly change the recovery settings so they can return later.
5. Run a full scan with the protection you trust. Choosing it well matters, so revisit our guide to the best antivirus software for Windows if your current setup is an expired trial from three laptops ago.
6. If money details were shared, call the bank using the number on your card. Banks handle this daily, can watch or freeze the card, and would always rather hear from you in the first hour than the third week.
7. Warn your contacts if your own account sent messages, and keep an eye on statements and sign-in alerts for the next few weeks.

Notice what is not on that list: replying to the suspicious message to ask if it was genuine, or paying anyone who offers to fix it for you. Both routes lead back to the same people. Every recovery step above goes through channels you initiate, to organisations you look up yourself. That principle — you start the conversation, through a route you trust — is the whole defence in one sentence.

Setting Up Your Inbox So Phishing Matters Less

Good routines deserve good scaffolding. Keep your mail app, browser and operating system updated, because updates quietly close the holes that malicious attachments exploit. Turn on two-factor authentication for your email account before any other account: control of your inbox means control of every password reset, which makes it the master key to your digital life. Protecting the network underneath matters too, and our guide on how to secure a home WiFi network covers the router settings that keep strangers off the connection your family shares.

Reduce the raw material attackers use. The less personal information is public — birthdays, workplaces, routines, email addresses on open profiles — the harder a convincing fake becomes. That is the theme of our upcoming guide on how to protect personal data online, and it pairs with a tidy inbox habit: unsubscribe honestly, report junk instead of just deleting it, and keep one folder where you save genuine messages from your bank and providers, so you always have real sender addresses to compare against a suspicious newcomer. And if your connection itself crawls whenever you try to do this housekeeping, our upcoming guide on how to fix slow WiFi will help you sort the network before the security.

Common Phishing Myths and Mistakes

Myth: phishing emails are always full of spelling mistakes. Some are, because they are mass-produced or deliberately filtered to find the least cautious readers. Many modern fakes are letter-perfect copies of real templates. Spelling is a clue when present, and proves nothing when absent.

Mistake: trusting the logo and layout. Copying a logo takes seconds, and the attacker has the same screenshots you do. Trust addresses, destinations and process — the boring parts — because those are what a fake cannot easily reproduce.

Myth: my provider or bank will never contact me, so all contact is fake. Real organisations do send alerts, statements and warnings. The safe response is not to ignore them; it is to answer them through the official app or number, never through the message itself.

Mistake: checking links on a phone by tapping them “just to look”. A tap is the click. Preview with a long press, or better, skip the link and verify separately. Curiosity is the attacker’s oldest friend.

Myth: antivirus makes phishing impossible to fall for. Security software blocks many malicious pages and attachments, and you should absolutely run it, but a fake login page with no malicious code can sail past tools designed to catch infections. Your routine is the layer that catches what software cannot judge: intent.

Frequently Asked Questions About How to Identify Phishing Emails

Can a phishing email come from a real person’s account?

Yes. When an account is taken over, attackers use it to message its real contacts, which is why a strange request from a genuine address still deserves verification. The address being real tells you the account sent it. It tells you nothing about whose fingers were on the keyboard. Verify unusual requests through a different channel, especially anything involving money, codes or secrecy.

Is it safe to open a phishing email just to read it?

Reading the text of a message in a modern, updated mail app is generally low risk. The danger lives in the actions: clicking links, downloading or opening attachments, loading remote content in old software, and replying with information. If you opened one to read it, you have not failed anything. Just do not continue to the interactive parts, and report and delete it when you are done.

Why do I receive phishing emails for services I do not use?

Because sending is nearly free and lists are bought, leaked and guessed in bulk. The attacker does not know or care whether you bank with the company in the message. Out of a million recipients, enough will. Treat an irrelevant lure as easy practice: spot its flags, report it, and enjoy the rare phishing message that could never have worked on you anyway.

What is the difference between phishing, spam and a scam call?

Spam is unwanted bulk mail, often merely advertising. Phishing is a specific impersonation attack designed to steal credentials, money or access. Scam calls and texts use the same scripts through other channels — voice phishing and text phishing respectively. The channel changes; the flags do not. Urgency, secrecy, unusual payment methods and requests for codes mean the same thing in every medium.

Should I report phishing emails, and to whom?

Yes, reporting genuinely helps, because providers use reports to train filters and block campaigns for everyone. Use the report phishing or junk option inside your mail app first. If the message impersonates a specific company, many firms run a dedicated reporting address listed on their official website — find it through the site you navigate to yourself, never through an address printed inside the suspicious message.

Can two-factor authentication stop phishing completely?

It raises the bar a lot, especially app-based and hardware methods, because a stolen password alone no longer opens the account. It is not absolute: sophisticated fake pages can try to relay a code in real time, which is why you should only enter codes on pages you reached yourself. Think of it as a strong lock that still deserves a careful doorkeeper — you, using the routine in this guide.

Conclusion: Slow Is Safe, and Safe Is Fast Enough

Learning how to identify phishing emails is not about memorising every trick. It is about installing one calm habit: when a message demands action, check the sender’s real address, preview the link, refuse requests for secrets, and verify through a route you chose yourself. Urgency is the attacker’s engine, so your slowness is not a weakness in the system. It is the system. Combine that routine with unique passwords from a good manager, two-factor authentication on your important accounts and software kept up to date, and the liars in your inbox lose almost all of their power. The next suspicious message is coming, for all of us. Now it gets a much less interesting afternoon than it was hoping for.