How to Spot a Phishing Email
Phishing attacks account for over 90% of successful data breaches. The emails have become increasingly convincing — but they still leave traces. Here are 8 warning signs to check before clicking any link.
1The sender address doesn't match the brand
The display name might say "PayPal Security" but the actual email address comes from paypal-alert@secure-accounts.net. Always hover over the sender name or tap it to reveal the actual email address. Legitimate companies send from their own domain — never from a generic Gmail, Outlook, or random domain.
2Urgent or threatening language
Phishing emails create pressure: "Your account will be suspended in 24 hours", "Unauthorized access detected — act now". This urgency is designed to make you react before you think. Legitimate companies do not threaten immediate account closure for routine issues.
3The link goes somewhere unexpected
Hover over any link before clicking. Red flags: the domain is misspelled (paypa1.com), uses a different TLD, or redirects through a URL shortener.
4Generic greetings
Phishing emails often say "Dear Customer" or "Hello User" because attackers send millions of messages without knowing your name. Companies you have an account with will address you by your name.
5Requests for sensitive information via email
No legitimate bank, payment service, or online store will ask for your password, full credit card number, or PIN via email. This is a universal rule — if an email asks you to confirm these details, it is fraudulent.
6Poor grammar, spelling errors, or odd formatting
While AI has made phishing emails more fluent, many still contain errors or inconsistent formatting. Look for inconsistent fonts, misaligned logos, and low-resolution images.
7Unexpected attachments
Never open attachments from unexpected emails. Common phishing payloads include PDF invoices, Word documents with macros, and ZIP files containing executables. Contact the sender through official channels to verify before opening.
8The domain sending the email fails authentication
Authentication failures can be a warning, but forwarding and configuration issues can also affect results. They do not prove who sent a particular message; inspect its links and verify requests through the organization’s official channel.
Frequently Asked Questions
What is a phishing email?
A phishing email is a fraudulent message designed to trick you into revealing sensitive information by impersonating a trusted organization such as your bank, a delivery company, or an online store.
What should I do if I receive a phishing email?
Do not click any links or download attachments. Mark the email as phishing in your email client. If you already clicked, change your passwords immediately and monitor your accounts.
Can phishing emails steal information without clicking?
In most cases, simply opening an email does not steal your data. The real risk comes from clicking links or downloading attachments.
Suspicious about a link in an email?
Check public technical details for a link’s domain. Domain age and email-authentication records are context only; they cannot authenticate the specific message or prove a sender is legitimate.
Analyze Any Domain Free →