How to Recognize a Phishing Email

What phishing emails are trying to do

A phishing email is designed to make you do one of a few things: click a link to a fake page, open an attachment, reply with sensitive details or make a payment. The message dresses itself up as something familiar, such as a bank, a delivery service, a workplace system or a colleague.

No single clue is decisive. Good phishing messages can look flawless, and genuine ones are sometimes badly written. The goal is to notice when several small oddities add up, and to have a safe way to check.

Start with the context, not the design

Before inspecting details, ask a simple question: was I expecting this?

• An unexpected request. A password reset you did not ask for, a parcel you did not order, a payment you did not make, or a document you did not expect.
• The wrong channel. Many organizations never ask for passwords or full card details by email. If a message does, treat it with caution.
• Unusual timing or tone. A senior colleague suddenly asking for gift cards, or a “support team” writing to you out of the blue.
• Pressure. Phrases about immediate suspension, legal trouble, a missed deadline or a prize that will vanish. Urgency is one of the most dependable signs because it is how phishing tries to bypass your judgment.

If the message does not fit your recent activity, the odds shift toward suspicion even before you look at the details.

The sender

• Display name versus address. The name shown can be anything. Look at the actual address, which most email programs reveal if you tap or hover over the name.
• Lookalike domains. Small changes, such as an extra letter, a swapped character or a different ending, can make an address resemble a real one. The part after the “@” matters most.
• A mismatch. A message that claims to be from a company but comes from a free personal address deserves a second look.
• Compromised accounts. Messages can occasionally come from a real account that has been hijacked, so a familiar sender is not proof. If a friend’s message seems out of character, check with them another way.

Links

Links are where most phishing succeeds.

• Hover before you click. On a computer, resting the pointer over a link shows its real destination. On a phone, pressing and holding often does the same.
• Read the web address carefully. The important part is the main domain just before the first single slash. Extra words placed in front, or a familiar name used as a subdomain of something else, are common disguises.
• Be careful with shortened links and buttons that hide the address.
• Avoid logging in through the message. Open your browser, type the organization’s address yourself or use a saved bookmark, and sign in there. This single habit defeats many phishing attempts. Using a password manager helps too, because it generally offers to fill credentials only on the address it saved, so a lookalike page may not trigger it.

Attachments

Unexpected attachments are risky, especially compressed files, documents asking you to enable editing or macros, and anything pretending to be an invoice or voicemail you were not expecting. If you must check one, confirm with the sender through a separate channel first. If a device may have been infected, the steps for malware removal become relevant.

Wording and presentation

• Generic greetings such as “Dear customer” when a real provider would know your name.
• A request to “verify” or “confirm” account details.
• Odd phrasing, formatting or spelling. These used to be dependable clues, but generative AI tools can produce clean text, so a polished message is not proof of honesty.
• Logos and layouts that look slightly off, or are suspiciously perfect copies. Appearance is easy to copy, which is why context and links matter more.
• Threats, or promises that sound too generous.

Variations to know about

• Spear phishing targets a specific person, using details from social media or old leaks. Because it seems personal, it is harder to spot.
• Business email compromise impersonates a manager or supplier to request payments or changed bank details. This overlaps with invoice fraud.
• Text and phone versions use the same tricks through other channels, and are covered separately under smishing and vishing.

What to do with a suspicious email

1. Do not click, reply or open attachments.
2. Check independently. Contact the organization using details you already have, not those in the message.
3. Report it. Many email programs have a “report phishing” option, and workplaces often have an internal reporting address.
4. Delete it once reported.

If you already clicked

Stay calm and act promptly. If you entered a password anywhere, change it on the real site and on any other account where you used it, because password reuse spreads the harm. Turn on two-factor authentication if it is available. If you entered card or bank details, contact your provider quickly. If you opened an attachment, run a security scan and consider asking a professional for help. At work, tell your IT contact straight away.

Making it routine

The aim is not to inspect every email like a detective. A few quick habits cover most of the risk: pause on anything unexpected, never log in through a link in a message, and verify requests involving money or credentials through a second route. Regular practice, whether personal or through workplace training, makes these habits automatic.