How to spot phishing emails: Tips & what to watch out for

How to spot phishing emails

Phishing emails are meant to look convincing. They may appear to come from a bank, delivery company, government agency, employer, coworker or brand you recognize—all to get you to click a link, open an attachment, send money or share personal information.

These scams are becoming harder to spot. Many now use polished designs, familiar logos and natural-sounding language, so spelling and grammar mistakes are no longer reliable warning signs. In fact, the Federal Trade Commission (FTC) reported that email was the most common way scammers contacted people.

Knowing which details to check, and taking a moment to verify unexpected requests, can help you avoid falling for a phishing scam. Here are the most common warning signs and what to do when an email does not feel right.

What is a phishing email?

A phishing email is a fraudulent message that pretends to come from a trusted person or organization. Its goal may be to:

Steal usernames and passwords
Collect financial or personal information
Convince you to send money
Install malware on a device
Gain access to an online account or workplace network

Phishing can also take several related forms:

Spear phishing: A targeted message tailored to a specific person, role, or organization
Business email compromise: An impersonation scam involving an executive, employee, client, or vendor, often used to request money or change payment details
Smishing: Phishing conducted through text messages
Vishing: Phishing conducted through phone calls

10 signs of a phishing email

Not every suspicious email will include all these warning signs. Even one unusual detail is a good reason to pause and verify the message.

The sender’s email address looks unusual
The display name may look familiar while the full email address contains misspellings, extra characters or an unrelated domain. Expand the sender details instead of relying on the name shown in your inbox.
The message was unexpected
Be cautious when an email arrives without context, especially if it mentions a delivery, invoice, password reset, prize, refund or account problem you were not expecting.
The email creates urgency or fear
Phishing messages often pressure you to act immediately by claiming that your account will be closed, a payment is overdue or suspicious activity has been detected.
Pro tip: Urgency is a reason to slow down, not speed up.
It asks for sensitive information
Legitimate organizations generally will not ask you to send passwords, Social Security numbers, payment details or verification codes through an unsolicited email.
The link does not match its destination
A link’s text may name a familiar company while directing you somewhere else. On a computer, hover over the link without clicking to preview the destination. On a phone, carefully press and hold it to view the address.
The email includes an unexpected attachment
Attachments may contain malware or direct you to a fake login page. Be especially cautious with unexpected invoices, shipping documents, shared files or compressed folders.
It requests money or a payment change
Watch for sudden requests to buy gift cards, send a wire transfer, pay through cryptocurrency or update a vendor’s banking information. Businesses should verify payment changes through a separate, trusted channel. It is also important to remember that government agencies typically do not request payments through gift cards, cryptocurrency, wire transfers, or other unconventional payment methods.
The greeting, wording or design feels off
The email may use an unusual greeting, inconsistent branding or language that does not sound like the supposed sender. However, a polished design does not prove that a message is genuine.
The offer seems too good to be true
Unexpected prizes, refunds, job offers, investments or giveaways may be designed to collect information or an upfront payment.
It contains an unusual login, MFA or QR-code request
A phishing email may ask you to approve a login you did not initiate, share a multifactor authentication code or scan a QR code to fix an account problem. Never approve a request you did not start. Phishing emails commonly use unexpected links, attachments, urgent requests and familiar company names to convince people to respond.

How to check whether an email is legitimate

When an email might be real but something feels off, use this verification process:

Stop before clicking. Do not reply, open an attachment, scan a QR code or use a link in the message.
Inspect the full sender address. Look for spelling changes, extra characters or an unexpected domain.
Review the context. Ask whether you expected the message and whether the request fits your previous interactions.
Visit the account independently. Open the official app or type the organization’s web address yourself.
Contact the sender separately. Use a phone number, email address or messaging channel you already know.
Ask someone else to review it. A coworker, friend, family member or IT professional may spot something you missed.

The FTC recommends contacting a company through a website or phone number you know is legitimate rather than using the contact details in an unexpected message.

What should you do with a phishing email?

If you identify a phishing email:

Do not reply, click links, open attachments or forward it casually.
Use your email provider’s Report phishing or Report spam option.
Notify the organization being impersonated when appropriate.
Send workplace messages to your IT or cybersecurity team.
Delete the email after reporting it.
Warn coworkers or family members if they may receive the same message.

For businesses, phishing attempts can reveal gaps in employee training, email filtering, verification processes or account security. The FTC recommends regular employee education because phishing tactics continue to change.

What should you do if you clicked a phishing link?

Clicking a suspicious link does not always mean your information was stolen, but it is important to act quickly:

Close the page. Do not enter more information or download anything.
Disconnect the device if needed. If a file is downloaded or the device behaves strangely, disconnect it from Wi-Fi or the workplace network.
Run a security scan. Update your security software before scanning the device.
Change affected passwords. Use a trusted device and start with your email account.
Replace reused passwords. Change the password anywhere else you use it.
Turn on multifactor authentication.
Contact financial providers. Alert your bank or card issuer if payment information was exposed.
Notify your employer. Contact IT or security immediately if a work account or device was involved.
Monitor your accounts. Check for unfamiliar logins, purchases, transfers or profile changes.
Protect your identity. Consider a fraud alert or credit freeze if identifying information was exposed.

How to protect yourself from future phishing attempts

A few layers of protection can reduce both the chance that a phishing message reaches you and the damage it can cause:

Use strong, unique passwords and store them in a password manager.
Turn on multifactor authentication, preferably using a phishing-resistant method when available.
Keep operating systems, browsers, apps and security software updated.
Enable spam and phishing filters.
Review account alerts and recent login activity.
Never share verification codes or approve login requests you did not initiate.
Back up important files regularly.
Limit personal and workplace information shared publicly.
Provide regular phishing training and a clear reporting process at work.

Businesses should also use email authentication tools such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC).

These controls help receiving email systems verify authorized senders and reduce domain spoofing. Cybersecurity and Infrastructure Security Agency (CISA) and the FTC recommend using multiple safeguards because filters and employee awareness alone cannot stop every phishing attempt.

Stay one step ahead of phishing scams

Phishing emails can look convincing, especially when they imitate a company or person you trust. The safest response is to pause, inspect the details and verify the request through a separate channel.

Do not let urgency push you into clicking, sharing information, or sending money. A few extra moments of caution can help protect your accounts, devices, personal information and finances.