How to Spot a Phishing Email Before You Click

Phishing emails are messages designed to trick you into handing over a password, clicking a harmful link, or opening a dangerous attachment. They often pretend to come from your bank, a delivery company, your employer, or a service you actually use. The good news is that most phishing emails give themselves away if you slow down and check a few details before you click anything.

Step 1: Pause when a message pushes urgency or fear

Phishing relies on speed. Watch for messages that warn your account will be closed today, a payment failed, a package cannot be delivered, or you must verify your identity right now. Real companies do send urgent messages sometimes, but urgency plus a demand to click a link is a classic warning sign.

If a message makes your stomach drop, that is exactly the moment to stop. Do not click, do not reply, and do not download anything. Give yourself a minute to check the message properly instead of acting on the first feeling it creates.

Step 2: Check who really sent it

Look closely at the sender name and address, not just the display name. A message can show “PayPal Support” as the name while the actual address is something unrelated. Tap or hover over the sender name to reveal the full address. Be suspicious of addresses with extra words, misspellings, or odd domains, such as a well-known company name followed by a random suffix.

Also check how the message greets you. Many phishing emails use a generic greeting like “Dear Customer” because the sender does not know your name. A real message from a service you use will usually address you by name, though a generic greeting alone does not prove a message is fake.

Step 3: Inspect links without clicking them

Hover over any link with your mouse, or press and hold it on your phone, to preview where it really goes. The preview address is what matters, not the text on the button. Be wary of links that use lookalike domains, such as a letter swapped for a number, an extra word added to a brand name, or a shortened link that hides the destination.

A safer habit is to skip the link entirely. If a message claims a problem with your account, open your browser and go to the official site yourself, or open the company’s app, and check there. If there is really a problem, you will see it after signing in the normal way.

Step 4: Treat attachments and codes with suspicion

Unexpected attachments are a common way phishing spreads malware, especially files with names like “invoice,” “receipt,” or “shipping details” that you did not ask for. Do not open an attachment from a sender you do not recognize, and be careful even with familiar senders if the message feels out of character.

Never share a verification code from a text message or authenticator app in reply to an email. Real support teams will not ask for your one-time code by email. If a message asks for a password, a full card number, or a verification code, assume it is a scam.

Step 5: Look for small mistakes and odd details

Phishing emails often contain spelling errors, awkward wording, strange formatting, or logos that look slightly off. These details are not proof on their own, since real companies make typos too, but several small mistakes together should raise your guard.

Also check whether the message matches how the company normally contacts you. If your bank has never emailed you about a locked account before, a sudden email about one deserves extra doubt. When in doubt, contact the company through a channel you already trust, like the number on the back of your card or the official support page.

Step 6: Report it and delete it

If you decide a message is phishing, report it before you delete it. Most email apps have a “Report phishing” option in the message menu, and your email provider uses those reports to block similar messages for others. In the US, you can also forward phishing emails to reportphish@apwg.org and report scams to the Federal Trade Commission at reportfraud.ftc.gov.

Then delete the message from your inbox and trash. If you already clicked a link or entered details, change that account’s password right away from the official site, turn on two-factor authentication if it is not already on, and check the account for unfamiliar activity.

Frequently Asked Questions

Can a phishing email infect my device just by opening it?

Opening a message to read it is usually not enough to cause harm on its own. The danger comes from clicking links, downloading attachments, or entering information on a fake site. Still, do not interact with a suspicious message beyond reading it.

What if a phishing email looks exactly like a real one?

Some phishing messages copy real designs very well, so judge by the sender address and the link destination, not by the look. When you are unsure, go to the official site or app yourself instead of using anything in the message.

I already entered my password on a phishing site. What now?

Change the password immediately on the real site, turn on two-factor authentication, and check for unfamiliar activity or changed settings. If you reused that password anywhere else, change it on those accounts too.