How to Recognise Phishing Emails: Signs and Safe Checks

A phishing email is a fake message made to look as if it comes from a real company or person. Its goal is to get you to hand over passwords, card numbers or other private details. Warning signs can help, but no short checklist proves that an email is genuine. Verify an unexpected request through an app, address or contact route you already trust. Knowing how to recognise phishing emails matters because scammers send thousands of these messages every day and rely on you reacting quickly rather than checking carefully.

Most phishing emails share a handful of warning signs once you know where to look. This article explains what to watch for, how to check a suspicious message safely, and what to do if you think you have already been targeted.

What Are the Warning Signs in an Email?

Phishing emails usually contain at least one of a small set of common warning signs, even when they look polished. Scammers have improved their designs over the years, but the underlying tactics remain similar because they still work.

Check the Sender Address, Not Just the Display Name

The sender can choose any display name, including “Your Bank” or “Amazon Support.” Check the full email address behind the name instead.

A spoofed sender often uses a domain that looks close to the real one but isn’t. It might contain an extra letter, use a number in place of a letter, or use a completely different domain, such as a free email service added to a company name. Microsoft advises watching for subtle misspellings, such as a zero replacing the letter “o” in a company’s domain name. These small changes are easy to miss at a glance.

Question Urgent Demands and Requests for Private Details

Urgency is a warning sign worth checking, not proof of fraud on its own. Messages claiming your account is “on hold”, that you must act “immediately”, or that you’ll lose access unless you respond within hours are designed to stop you thinking clearly.

An unexpected request for passwords, PINs or full card numbers deserves independent verification. The FTC also notes that firms won’t send an unexpected link asking you to update your payment details. Treat any such request for sensitive information as suspicious.

Treat Unexpected Links, QR Codes and Attachments with Caution

Unexpected attachments and links carry the real risk in a phishing email. A file you weren’t expecting, even one that looks like an invoice or shipping label, can install malware if you open it.

QR codes are a newer version of the same trick. Sometimes called quishing, this tactic uses a QR code to send you to a fake login page instead of a web address you can check. Treat a QR code in an unsolicited email with the same caution you’d give a link.

Look Beyond Generic Greetings and Spelling Mistakes

A generic greeting like “Dear Customer” instead of your name is a classic sign, as companies you have an account with usually know who you are. Spelling and grammar mistakes are another traditional warning sign, though they are becoming less reliable.

AI phishing tools let scammers write fluent, well-formatted emails with no typos. Spear phishing messages built around personal details you’ve shared online can also look far more convincing than older mass scams. Don’t rely on poor writing alone to spot a fake.

How Can You Check a Suspicious Message Safely?

Check a suspicious email safely by verifying links and requests through channels you already trust, never through the email itself. This helps you avoid fake websites and login pages designed to capture your details through social engineering.

Inspect a Link’s Destination Without Opening It

Before you consider clicking anything, hover your mouse pointer over the link without pressing it. Most email programs show the real destination address in a small box or in the status bar.

Compare the address carefully with the company’s known website. On a phone, avoid interacting with an unknown link just to test it. Open the known app or type the trusted address independently. An apparently familiar link is not enough to establish that the request is genuine.

Open the Service Yourself Instead of Using the Email’s Link

Close the email and open a new browser tab. Type the company’s known website address yourself, or use a bookmark you saved previously. Then log in to check for any real account issue.

This avoids relying on the email’s chosen destination. Still check that you are using the expected official service; the habit does not certify the device, browser or every page you might open. The same applies to phone numbers listed in a suspicious email: look up the company’s real number independently rather than calling the one provided.

Confirm Unusual Requests Through a Contact Method You Already Trust

If an email appears to come from a colleague, friend or family member asking for money, gift cards or sensitive files, contact that person through a different channel. For example, call them or text a number you already have saved. Do not use a reply to the suspicious email as confirmation. The sender could be impersonated or a genuine account could have been compromised.

Follow the same rule if a message seems to come from your employer’s IT department or a manager. Confirm through a known internal channel before acting.

What Should You Do with a Suspected Phishing Email?

Report a suspected phishing email, then delete it without clicking anything inside it. What to do next depends on whether you have already interacted with the message.

Report the Message, Then Remove It

Most major email providers, including Gmail and Outlook, have a built-in “Report phishing” option, usually in the menu next to the reply button. Using this option helps your provider’s spam filters catch similar messages in future.

The FTC’s phishing guidance lists US reporting options. Consumers in the US can report scams directly to the FTC at ReportFraud.ftc.gov. For personal email, the UK NCSC accepts suspicious messages at [email protected]; US reporting and recovery services have their own scope. For work email, use your organisation’s reporting and evidence-retention process before forwarding or deleting a message. Do not send confidential work material to an outside service without authorisation. For personal mail, report it and remove it from ordinary use.

If You Opened a Link or Attachment, Assess What Happened

Reading a message alone does not establish that the device is infected. Keep the mail app and operating system updated, do not enable unexpected content or approve further prompts, and seek device or workplace support if warnings or unexplained activity appear.

If you clicked a link but didn’t enter any information on the page that followed, close the browser tab. Don’t enter anything if you’re unsure the site is genuine. If you opened an attachment, update your security software immediately and run a full scan. Remove anything it flags, following the approach recommended by the FTC’s phishing guidance.

If You Shared Details or Approved a Sign-In, Secure the Affected Accounts

If you entered a password or approved a login prompt you did not request, secure the affected account immediately. Change an exposed password through the official app or website and change any reused copies on other accounts. If you supplied payment details or sent money, contact the bank or payment provider through a trusted route; changing an account password does not by itself resolve a payment exposure.

Turn on multi-factor authentication for the account if it isn’t already active. Review recent sign-ins, recovery details, unfamiliar access and active sessions using the provider’s security controls. Revoke access you do not recognise where supported; account recovery can require more than a password change. For US identity-information exposure, such as a Social Security number, use IdentityTheft.gov for steps based on exactly what information was exposed. Contact your bank directly if financial details were involved, using the number on your card or statement, not one from the email.

How Can You Reduce Your Risk Next Time?

You can reduce your phishing risk with a mix of awareness and technical safeguards, since no single tool catches every attempt. The layers address different risks, and none provides complete protection.

Use Account and Device Protections as Additional Layers

Multi-factor authentication makes account takeover harder, but codes and approval prompts can still be targeted. Where the service supports it, consider phishing-resistant FIDO/WebAuthn authentication, such as a suitable security key or passkey. Do not approve a sign-in you did not start, and keep recovery access secure. Set your operating system, browser and security software to update automatically so known vulnerabilities are patched without you needing to remember.

Back up important files to an external drive or cloud storage. This limits the damage if malware from a phishing attachment gets through. These layers work alongside your own judgement, not instead of it.

Know What Email Filters and Sender Checks Cannot Prove

Spam filters and email-authentication mechanisms help reduce some forms of spoofing, but an authentication result does not validate the message’s business request. However, well-crafted phishing emails can still get through if they use a newly registered domain or a compromised legitimate account. In those cases, the technical sender check passes even though the content is fraudulent.

A filter catching most junk doesn’t mean every message in your inbox is safe. Treat filters as one layer, not a guarantee.

Apply the Same Verification Habit to Texts, Calls and QR Codes

Phishing extends well beyond email. Smishing uses text messages to push the same urgent links, while vishing uses phone calls to pressure you into revealing information or approving a fraudulent transaction.

The same core habit applies everywhere: don’t use contact details or links provided in the suspicious message itself. Look up the organisation independently and verify through a channel you already trust, whether the attempt arrived by email, text, call or QR code.

Pause and Verify Before You Act

Pausing before you respond stops many phishing attempts from working because these scams depend on you reacting before you think. Scammers build urgency and fear into their messages to make you skip the checks covered above.

When a message pushes you towards an immediate decision, step away for a moment. Close the email, put the phone down, or wait a few minutes before doing anything else with it.

Then verify independently, using a phone number, app or website address you already know is genuine, never one supplied in the message. Pausing and verifying separately can protect you from many phishing attempts, even as scammers’ tactics change.

Frequently Asked Questions

Sources

Guidance checked 10 November 2026: FTC phishing advice, UK suspicious-message reporting, NCSC reporting guidance and CISA phishing-resistant authentication guidance.

Share this article

WhatsAppLinkedInRedditFacebookX