How to Spot a Phishing Email Before You Click

A phishing email pretends to come from someone you trust so you will click a link, open an attachment, enter a password or send money. For years the advice was to look for bad spelling. That clue is fading, because scammers now use the same writing tools everyone else does. Their messages can be clean, friendly and convincing.

What still gives them away is the combination of who sent it, where the link really goes and what they want you to do. Here is how to check all three in under a minute.

Check the sender, not just the name

Your email app shows a display name, such as "Accounts Team" or the name of your bank. That name can be set to anything. Tap or hover over it to see the actual address behind it.

Look for:

• A domain that does not match the company. A message from your bank should come from your bank's domain, not a free email service or a string of random letters.
• Lookalike spellings. Scammers swap similar characters, such as the number 1 for the letter l, or "rn" for "m," or add extra words like "secure" or "support" to a real brand name.
• A reply-to address that differs from the sender, so your answer goes somewhere else.
• A familiar sender asking for something unusual. Real accounts get hacked. A message from a coworker or friend can still be phishing if the request is out of character.

Check where the link really goes

Before you click, find the real destination. On a computer, hover the mouse over the link and read the address that appears. On a phone, press and hold the link to preview it without opening it.

Read the web address from the end of the domain backward. In an address like secure-login.yourbank.com.account-check.net, the real site is account-check.net, not your bank. Everything before it is decoration chosen to fool you.

When in doubt, do not use the link at all. Open the company's app or type its address yourself, then sign in and look for the message there.

Check what they are asking you to do

Phishing always wants an action. Be suspicious when an email asks you to:

• Sign in to "verify," "unlock" or "keep" your account.
• Pay an invoice, update payment details or buy gift cards.
• Share a sign-in code. No legitimate company needs your one-time code.
• Open an unexpected attachment, especially compressed files, web page files or documents that ask you to "enable content."
• Act within hours to avoid a penalty, suspension or missed delivery.

Pressure is the pattern. Scammers want you to act before you think.

Common disguises to recognize

• Shared document notices saying someone sent you a file to review, with a login page that steals your email password.
• Invoices and receipts for purchases you did not make, with a phone number to "cancel."
• Delivery problems asking for a small redelivery fee.
• Account suspension warnings from email, streaming, banking or social media services.
• Payroll or HR updates asking staff to confirm direct deposit details.
• QR codes in emails, which hide the destination address from quick inspection and move you to your phone, where links are harder to check.

If one of these arrives at work, a related scam is worth knowing: our guide to invoice fraud and fake payment requests covers the payment side in detail.

What to do with a suspicious email

1. Do not click, reply or open attachments.
2. Verify through a separate channel. Call the person or company using a number you already have, or log in through the official app.
3. Report it. Most email services have a "Report phishing" or "Report spam" option. At work, forward it to whoever handles security, the way they prefer.
4. Delete it once reported.

If you already clicked

Mistakes happen to careful people. What matters is acting quickly and without shame.

• If you entered a password, go directly to that service's real website and change it right away, then turn on two-factor authentication. Change it anywhere else you used the same password.
• If you entered card or bank details, call your bank or card issuer using the number on the back of your card.
• If you opened an attachment, disconnect from the internet, run a full scan with your security software, and tell your workplace's IT contact if it was a work device.
• If your email account starts acting strangely, follow our steps for a hacked email account.

At work, report a click immediately. Teams that respond without blame find out about problems sooner, and sooner is everything.

Frequently asked questions

Can I get hacked just by opening a phishing email?

With an up-to-date email app, simply opening a message is generally low risk. The danger comes from clicking links, opening attachments or replying with information. Keep your software updated to reduce risk further.

Is it phishing if it comes from someone I know?

It can be. If a contact's account is compromised, scammers send messages from it. Treat unusual requests with the same caution and confirm by phone or text before acting.

Should I click unsubscribe on a scam email?

For obvious scams, no. The unsubscribe link may confirm your address is active or lead to a malicious page. Mark the message as spam or phishing instead.