How to spot a phishing email: 8 signs to check
Concrete signs that a message is trying to trick you, and what to do when you find one.
What phishing looks like
A phishing email pretends to come from someone you trust so that you will do something: sign in on a fake page, pay an invoice, open a file, or reply with information. The best ones look exactly like real mail from your bank, a delivery company, a colleague or your IT team. Spotting them comes down to checking a few specific details rather than judging how polished the message looks.
Check the sender and the links
1. Read the full address, not the name. A message from Apple Support could come from support@apple-id-verify.example. Click or hover on the sender to see the real address.
2. Look for lookalike domains. Scammers register names such as amaz0n.com, rnicrosoft.com (rn in place of m) or paypal.com.account-check.example. To find the real domain, look at the end of the address, just before the first single slash: in login.paypal.com.account-check.example/verify, the domain is account-check.example, not paypal.com.
3. Hover over links before clicking. The text can say anything; the link address is what matters. On a Mac, hovering over a link in most mail apps shows the real address.
4. Compare Reply-To with From. A message from your CEO with a Reply-To at a free mail address is a classic sign of invoice fraud.
Check what it asks you to do
5. Urgency and threats. Your account will be closed in 24 hours, a payment failed, unusual sign-in detected, a package is held. Pressure is meant to stop you from checking.
6. Requests to sign in or pay. Real companies rarely need you to sign in from an email link, and a request to change bank details for a supplier should always be confirmed by phone using a number you already have.
7. Unexpected attachments. Be careful with HTML files, ZIP archives, disk images (.iso, .img), Office files that ask you to enable macros, and PDFs whose only content is a button. QR codes are also used to move you to a phone, where links are harder to inspect.
8. Small mismatches. A greeting that does not use your name, an order you never placed, a logo that looks slightly off, or a tone that does not match how the person usually writes.
What to do with a suspicious message
Do not click links or open attachments. If the message might be real, go to the company's site by typing its address yourself, or open its app, and look for the same alert there. For a request from a colleague, confirm by phone or chat.
Report it. Most mail providers have a Report phishing or Report junk option, and work accounts often have a way to send it to the security team. If you already entered a password, change it right away on the real site, turn on two-factor sign-in, and check for sign-ins you do not recognize.
Questions
- Can I trust a message that passed SPF, DKIM and DMARC?
- It tells you the mail really came from the domain in the From address. It does not tell you that domain is the company you think it is, since scammers can set up all three for a lookalike domain.
- Is it safe just to open a phishing email?
- Opening it is generally low risk. The danger is in clicking links, opening attachments or replying. Opening can still confirm your address to the sender if the message loads remote images.