"Your mailbox is almost full." "Invoice #4471 attached." "We couldn't deliver your package." Phishing emails borrow the boring, everyday messages you are used to clicking without thinking. Thirty seconds of checking is enough to catch nearly all of them.
Before clicking, check three things: who really sent it (the address, not the name), where the link really goes (hover or long-press), and what it wants you to do. A surprise request to log in, pay, or open an attachment, with time pressure attached, is the classic phishing pattern.
The 12 signs
- The display name and the address don't match. "PayPal Service" sending from a free webmail account or a random domain.
- The domain is almost right. Extra words, swapped letters or a different ending:
micros0ft-support.com,amazon.account-help.net. - The link goes somewhere else. Hover or long-press: the real address differs from the text you see.
- You did not expect it. An invoice you never ordered, a delivery you are not waiting for, a password reset you did not request.
- It creates urgency. Account closure, legal action, a fine or a deadline within hours.
- It asks you to log in from the email. Real services increasingly avoid this; safer to open the app or type the address.
- It has an unusual attachment. Zipped files, HTML attachments, Office files asking you to "enable content", or a PDF with a link to "view the document".
- It contains a QR code asking you to scan to verify or pay. See QR code scams.
- The greeting is generic, or uses your email address instead of your name.
- The reply-to address is different from the sender.
- It asks for payment by unusual means, such as gift cards, crypto or a new bank account.
- Something feels slightly off: an old logo, an odd footer, a tone your bank or boss never uses.
How to check a link safely
Read the domain from the right: the part immediately before the first single slash is who owns the page. login.microsoft.com.secure-check.co belongs to secure-check.co. If in doubt, copy the link into our link checker, which follows every redirect on our server and checks the final site against phishing lists. For the whole message, paste it into the scam message checker.
Phishing that targets work email
At work, phishing often impersonates IT ("your password expires today"), file-sharing services ("a document was shared with you") or the boss ("are you available? I need a quick favor"). Requests to change supplier bank details are covered in our guide to invoice fraud. Report suspicious work emails to your IT team instead of deleting them, so they can block them for everyone.
Phishing in the age of AI
Spelling mistakes used to be a giveaway. Now AI tools produce clean, personalized messages in any language. The signs that still work are structural: a mismatched address, a link to the wrong domain, and a request you did not expect.
If you clicked or entered details
- Password entered: change it on the real site and anywhere you reused it, then turn on two-step verification.
- Card details entered: call your card issuer and ask for a new card.
- Attachment opened: disconnect from the internet, run a security scan, and tell IT if it is a work device.
- Check your email settings for new forwarding rules or recovery addresses the attacker may have added.
- Report it with the report button, to reportphishing@apwg.org, and to the impersonated company.
Don't trust the name. Check the address, the link and the ask.
Frequently asked questions
What is phishing?
Phishing is a message that pretends to come from someone you trust so that you click a link, open an attachment, log in or pay. Email is the classic channel; texts (smishing) and calls (vishing) use the same tricks.
Can I get hacked just by opening an email?
Opening an email in a modern, updated mail app is usually safe. The risk comes from clicking links, downloading attachments or entering your details.
How can I check a link without clicking?
On a computer, hover over the link to see the real address. On a phone, press and hold it. Or copy it into a link checker that opens it on a server instead of your device.
The email came from the real company address. Can it still be fake?
Yes. Display names are easy to fake, and sender addresses can be spoofed when a domain lacks protection. Judge the request and the link, not just the sender.
Does good grammar mean an email is real?
Not anymore. AI tools write fluent emails in any language, so spelling mistakes are no longer a reliable sign.
What should I do if I entered my password?
Change it immediately on the real site, change it anywhere you reused it, turn on two-step verification and check your account for changes such as forwarding rules.
Where do I report phishing?
Use your email's "report phishing" button, forward it to reportphishing@apwg.org, and in the UK to report@phishing.gov.uk. Report it to the company being impersonated too.
Why do I get so many phishing emails?
Your address has probably appeared in a data breach or public list. Filters catch most, but some always slip through, which is why checking before you click matters.
Sources
- FTC: How to recognize and avoid phishing scams
- CISA: Avoiding social engineering and phishing attacks
- Anti-Phishing Working Group: Report phishing
- UK NCSC: Suspicious email reporting service
Figures are the latest available from each source at the time of writing. We review guides when official data or rules change. Spotted an error? Tell us.