Phishing emails remain one of the most common ways accounts get stolen, and they are harder to recognize than most people expect. Knowing how to spot a phishing email starts with understanding the tactics attackers use to make a fake message look trustworthy. In this guide, you will learn the ten most important red flags, what to do the moment one lands in your inbox, and how to keep your accounts safe even if a message slips past your guard.
1. Urgent or Threatening Language With Fake Deadlines
Attackers want you to act before you think. Classic phishing messages warn that your account will be suspended within 24 hours, that a payment failed and service ends tonight, or that unusual activity requires immediate confirmation. Real companies rarely use this tone. When an email creates a sense of panic and gives you a countdown, treat the message as suspect until you have verified it another way.
2. Generic Greetings Instead of Your Name
A message that opens with “Dear Customer,” “Dear User,” or “Hello Account Holder” should raise an eyebrow. Legitimate companies that know you almost always use your name in account-related emails. Attackers send the same message to thousands of people, so they cannot personalize it. A generic greeting alone does not prove a message is fake, but combined with other red flags it strengthens the case.
3. Mismatched or Lookalike Sender Addresses
The display name may say your bank’s name, but the actual address can be anything. Check the full email address carefully, not just the name shown. Attackers register lookalike domains such as support-paypaI.com (with a capital I instead of an L) or billing-amaz0n.net, and they use subdomains like secure.login.realbank.example.com where the real domain is example.com. If the domain does not exactly match the company’s official site, do not trust the message.
4. Suspicious Links That Do Not Lead Where They Claim
Hover your mouse over any link before clicking it, or long-press it on a phone to preview the real destination. Phishing links often hide behind anchor text like “Verify your account” while pointing to a completely different domain. Also watch for subtle tricks: http instead of https, hyphens and extra words added to a brand name, and URL-shortened links with no way to see the final page. A real company’s emails link to its own official domain.
5. Unexpected Attachments You Did Not Ask For
Attachments are a common delivery method for malware. An unexpected invoice, receipt, or “secure document” from an unknown or even a familiar-looking sender is a classic trap. Attackers also name files to trigger curiosity, like “Payment-Confirmation.pdf.exe” with the dangerous extension hidden. Never open an attachment you were not expecting, and never enable macros in an emailed document.
6. Requests for Passwords or Payment Details by Email
No legitimate bank, payment service, or tech company asks for your password, PIN, full card number, or one-time code by email. This is a hard rule. Phishing emails disguise the request as a “verification step” or an “account recovery” requirement, sometimes linking to a convincing fake login page. If a message asks for credentials or financial details, it is fraudulent, no matter how professional it looks.
7. Poor Grammar, and Why Perfect Grammar Means Nothing
Sloppy spelling, awkward phrasing, and odd formatting used to be reliable giveaways, and they still appear in cheap mass-phishing campaigns. But modern attackers use AI writing tools, so many phishing emails are now grammatically flawless. Clean writing does not mean a message is safe. Use the other red flags in this list rather than relying on language quality alone.
8. Prizes, Refunds, and Offers That Sound Too Good to Be True
Messages announcing you won a prize you never entered, a tax refund you never claimed, or a free product from a brand you never bought from are nearly always scams. The offer exists to make you click or hand over personal details. Real giveaways are public and announced through official channels, not via surprise emails with a link that expires in an hour.
9. Spoofed Branding and Slightly-Off Logos
Attackers copy real company logos, color schemes, and footers to look authentic. Look closely: slightly stretched logos, wrong fonts, off-brand colors, and footer links that do not match the company’s real site are all signs of imitation. Even a perfect-looking email can be fake, so never let professional design be your only test. Verify the sender and the links first.
10. Pressure to Bypass Normal Procedures
Some phishing emails impersonate your boss, a colleague, or a vendor and urge you to skip the usual process. The most common versions are gift card scams, where a “manager” asks you to buy gift cards urgently and share the codes, and fake invoice fraud, where a “supplier” sends new payment details. Any request that pressures you to ignore normal verification steps should be confirmed through a separate, trusted channel before you act.
What to Do When You Receive a Phishing Email
If a suspicious message lands in your inbox, follow a simple routine. First, do not click any link, do not download any attachment, and do not reply. Second, verify the claim independently: open your browser and go to the company’s official site or app directly, never through the email’s link. If your bank or a service you use runs a separate support line or help center, check there. Third, report the message. Most email providers have a “Report phishing” or “Mark as spam” option that helps filter future attacks, and you can forward phishing to your country’s cybercrime reporting service. Finally, if you clicked a link or entered details before realizing it was fake, act quickly: change that password immediately, enable two-factor authentication, and watch the account for unusual activity.
Do Not Forget Your Phone Accounts
Phishing is not limited to email. Text messages and fake delivery notifications are just as common, and losing access to your phone number or Apple and Google accounts can be worse than a single email account breach. Strong, unique passwords and two-factor authentication are your baseline, but you should also have a recovery plan. Keeping regular backups of your important data means an account lockout or a malware infection does not turn into a permanent loss — see How to Back Up Your Phone: The Complete iPhone and Android Guide for a step-by-step process. And since malicious attachments can slow down or damage a device, it helps to know How to Speed Up a Slow Laptop: 12 Proven Fixes That Actually Work in case your machine starts behaving strangely after an incident.
FAQ:
Can a phishing email come from a real person’s address?
Yes. If someone’s account is hacked, attackers send phishing messages from it. The same applies to spoofed addresses that look real at a glance. Always check the full address and be suspicious of out-of-character requests, even from people you know.
What if I already clicked a link in a phishing email?
Do not enter any information on the page, close the tab, and run a security scan. Then change the passwords of any accounts that could be affected and enable two-factor authentication where available.
Does my email provider catch all phishing emails?
No. Spam filters catch most, but attackers constantly adjust. Treat your inbox as the last line of defense and review unexpected messages with the red flags above.
Conclusion
Spotting a phishing email comes down to slowing down and checking the details: the sender’s real address, the link’s true destination, the tone of the request, and whether the message asks for something a legitimate company never would. Learn to spot a phishing email by making verification a habit — check independently, report what you find, and keep your devices and accounts protected with strong authentication and regular backups.
