How to Spot a Phishing Email

You open your inbox and see a message claiming that a parcel is waiting, your bank account needs attention, or a payment has failed. It looks official, but something about it does not feel right. Knowing how to spot phishing email messages can help you avoid scams and protect your personal information.

Phishing is a type of online scam in which someone pretends to be a trusted person or organization to trick you into sharing information, opening an unsafe attachment, or sending money. The warning signs are often small, and you do not need special technical knowledge to check them. This guide shows you what to look for and what to do if a message seems suspicious.

What you’ll need

• Access to your email account.
• A moment to check a message calmly before responding.
• The official website or phone number of the organization, if you need to contact it.

Step 1: Look closely at the sender’s email address

A phishing email may use the name of a real bank, delivery company, shop, or government service. The display name is the name shown in your inbox, and scammers can often make it look convincing.

1. Open the message only if you can do so without opening an attachment or following a link. Viewing an email is generally safer than interacting with its contents.
2. Look at the sender’s full email address, not just the name displayed beside it.
3. Check the part after the @ symbol. Does the domain match the organization’s genuine website?
4. Look for misspellings, extra words, unusual punctuation, or a domain that has nothing to do with the organization.
5. If the message claims to be from someone you know, check whether the address is one you recognize.

For example, an email claiming to be from a delivery company but sent from a personal email account deserves caution. However, a familiar-looking address is not proof that a message is genuine. Email addresses can be spoofed, which means a scammer can make the sender details appear misleading.

Tip: Do not rely on the sender’s display name or logo. Check the full address and consider whether you were expecting the message.

Step 2: Be wary of urgent or threatening language

Scammers often try to make you act before you have time to think. They may claim that your account will be closed, a parcel will be returned, or an unexpected charge will be taken unless you act immediately.

1. Read the message again and notice whether it creates pressure.
2. Look for demands to act within minutes or hours.
3. Be cautious if it threatens consequences, asks you to keep the message secret, or says you must not contact customer support.
4. Pause instead of following the instructions.
5. Check the claim through the organization’s official app, website, or a phone number you already trust.

Real organizations sometimes send reminders about genuine problems. The warning sign is not urgency on its own, but pressure combined with a request to click a link, provide information, or make a payment.

Careful: A countdown, threat, or warning that your account will be closed is not a reason to rush. Take time to check the claim independently.

Step 3: Check links without opening them

A message may include a button such as View Invoice, Track Parcel, or Verify Account. The button text does not tell you where the link really goes.

1. On a computer, move your mouse pointer over the link or button without clicking it.
2. Look for the destination address shown near the bottom of the browser window or in a small preview.
3. Check whether the website address belongs to the organization the email claims to represent.
4. Watch for misspelled names, extra words, unexpected endings, or unrelated domains.
5. If you are unsure, do not use the link. Open the organization’s official app or type its known website address into your browser yourself.

On a phone or tablet, you may be able to press and hold a link to preview its address. Do not choose an option that opens it. If you cannot check the destination confidently, leave the link alone and verify the message another way.

A padlock symbol or an address beginning with HTTPS only means that the connection to that website is encrypted. It does not prove that the website is genuine or trustworthy.

Step 4: Watch out for unexpected attachments and requests for information

Phishing messages may ask you to open an invoice, delivery notice, voice message, or document. Attachments can contain harmful software, and fake sign-in pages can be used to steal passwords.

1. Think about whether you were expecting the attachment.
2. Check whether the sender and the reason for sending it make sense.
3. Be especially cautious about unexpected files, even if the message looks familiar.
4. Do not open an attachment if you are unsure it is safe.
5. Never reply with your password, one-time security code, full payment details, or other sensitive information.

A one-time code is a temporary number sent to help verify your identity. A genuine support representative should not ask you to tell them a code that was sent to your phone or email so they can sign in as you.

If a message asks you to pay using gift cards, cryptocurrency, or an unusual transfer method, treat it as a serious warning sign.

Good to know: Banks and other legitimate services should not ask you to send your password by email. Do not share security codes with someone who contacts you unexpectedly.

Step 5: Check the message for other warning signs

Poor spelling and strange formatting can be clues, but modern phishing emails may be carefully written and look professional. Use several clues together rather than relying on one.

1. Check whether the message greets you in a vague way, such as Dear Customer, when the organization normally addresses you by name.
2. Look for unexpected requests for payment, account details, or personal information.
3. Check whether the message makes sense in context. Were you expecting a parcel, invoice, password reset, or account notice?
4. Notice whether the sender asks you to move the conversation to an unfamiliar phone number or messaging app.
5. Be cautious if the message seems unusual for the person or company it claims to come from.

Your name, a company logo, and accurate personal details do not guarantee that an email is genuine. Scammers can sometimes obtain or copy these details.

Step 6: Report and delete a suspicious email

If you think a message is phishing, you can usually report it through your email service.

1. Do not click links, download attachments, or reply.
2. Open the message’s options menu.
3. Choose Report phishing, Report spam, or the closest available option. The wording depends on your email provider.
4. Follow any confirmation prompt.
5. Delete the message if your email service does not move it automatically.

Reporting helps your email provider identify similar messages. If the email appears to come from your bank, delivery company, or another organization, you can also report it through that organization’s official website.

In the US, suspicious messages can be reported to the Federal Trade Commission at ReportFraud.ftc.gov. In the UK, you can forward suspicious emails to report@phishing.gov.uk. Do not forward an email if doing so would expose someone else’s private information.

What if you already clicked a link or shared information?

Do not panic, but take the situation seriously. What to do depends on what happened.

• If you only opened the email: Close it and avoid interacting with its links or attachments.
• If you opened a link but entered nothing: Close the page. Do not download anything or approve unexpected prompts.
• If you entered a password: Go directly to the genuine website or app, change that password, and change it anywhere else you reused it. Turn on two-step verification if available.
• If you shared bank or card details: Contact your bank immediately using the number on your card or its official website. Follow its advice about protecting the account.
• If you downloaded or opened an unexpected file: Stop interacting with it and use your device’s trusted security software to check the computer. If you think the device is compromised, use another trusted device to change important passwords.

If you are in the UK, you can report fraud or cybercrime through Report Fraud. In the US, use ReportFraud.ftc.gov for scams and follow your bank’s instructions if financial information was involved.

Stay calm and check before you click

Learning how to spot phishing email messages is mostly about pausing and checking. Look at the sender, be cautious with urgent requests, avoid unexpected links and attachments, and verify important claims through official channels. If a message feels unusual, it is always safer to check first.