Phishing emails are the most common way criminals steal passwords, money and personal information. They pretend to be your bank, a delivery company, a streaming service, your employer or even a friend, and they are getting harder to spot as scammers use AI to write convincing messages. The good news is that most phishing emails still share recognizable red flags. This guide teaches you how to tell if an email is a phishing scam, with twelve warning signs, real examples and exactly what to do if you clicked a link.
What is phishing?
Phishing is a type of scam where criminals send messages that look legitimate to trick you into clicking a malicious link, opening an infected attachment, entering login details on a fake website, sending money or sharing personal information. Variations include smishing (text messages), vishing (phone calls) and spear phishing (targeted messages using personal details).
12 red flags of a phishing email
1. The sender’s address doesn’t match
The display name may say “PayPal” or “Netflix,” but the actual email address is something like “support@paypa1-security.com” or a random Gmail address. Tap or hover over the sender’s name to see the full address.
2. Generic greetings
“Dear Customer” or “Dear User” instead of your name can be a sign, although some scammers use your name too.
3. Urgency or threats
Phrases like “Your account will be closed in 24 hours,” “Immediate action required” or “Unusual login detected” are designed to make you panic.
4. Links that go somewhere unexpected
Hover over a link on a computer, or press and hold on a phone, to preview the real URL. If it does not match the company’s official domain, do not click.
5. Requests for sensitive information
Legitimate companies rarely ask you to confirm passwords, full card numbers, Social Security numbers or one-time codes by email.
6. Unexpected attachments
Invoices, shipping documents or “secure messages” you were not expecting, especially files like .zip, .exe, .html or macro-enabled Office documents, can contain malware.
7. Too-good-to-be-true offers
Prizes, refunds, inheritance, crypto giveaways or job offers with unusually high pay are classic bait.
8. Payment requests in unusual forms
Requests to pay by gift cards, cryptocurrency or wire transfer are major warning signs.
9. Spelling and design mistakes
Some phishing emails have poor grammar, odd formatting or low-quality logos. However, AI tools now help scammers write polished messages, so good grammar does not mean an email is safe.
10. Mismatched details
The email references an order you never made, a service you don’t use or an account at a bank you don’t have.
11. Unusual requests from colleagues or bosses
“Can you buy gift cards for a client?” or “Please update the vendor’s bank details” from a manager’s look-alike address is a common business email compromise scam.
12. Login pages that look slightly off
If you land on a login page, check the URL carefully. Fake sites often use slight misspellings, extra words or different domain endings.
Real email vs phishing email
| Legitimate email | Phishing email | |
|---|---|---|
| Sender domain | Official company domain | Look-alike or unrelated domain |
| Greeting | Often uses your name | Often generic |
| Tone | Calm, informational | Urgent, threatening or exciting |
| Links | Go to official website | Go to strange or misspelled domains |
| Requests | Rarely asks for passwords or codes | Asks you to “verify” sensitive information |
| Payment | Through official channels | Gift cards, crypto, wire |
Common phishing scams right now
| Scam | What it says |
|---|---|
| Delivery problem | “Your package couldn’t be delivered. Pay a small fee to reschedule.” |
| Account suspended | “Your Netflix or Amazon account has been suspended. Update billing.” |
| Bank alert | “Suspicious activity detected. Verify your identity.” |
| Tax refund | “You’re eligible for a refund. Submit your bank details.” |
| Fake invoice | “Your subscription renewed for $499. Call to cancel.” |
| Microsoft or Google security | “Your password expires today. Click to keep it.” |
| Job offer | “You’re hired for a remote position. Send your ID and bank info.” |
The fake invoice scam is often paired with phone calls. See how to stop spam calls on iPhone.
How to check if an email is real
- Do not click links. Instead, open the company’s app or type its official website into your browser and log in there.
- Call the company using a phone number from its official website or your card, not from the email.
- Check your account directly for any alerts or messages.
- Look at the email headers if you are comfortable doing so, to see the real sending server.
- Use your email provider’s warnings. Gmail and Outlook often flag suspicious messages.
What to do if you clicked a phishing link
- Don’t enter any information. If you only clicked and closed the page, your risk is lower.
- If you entered a password, change it immediately on the real website, and anywhere else you use the same password.
- Turn on two-factor authentication. See how to set up two-factor authentication on Gmail.
- If you shared financial details, contact your bank, lock your card and watch for charges. See what to do if you see an unknown charge.
- If you downloaded an attachment, run a security scan and update your software.
- Report the email using your email provider’s “Report phishing” option and forward phishing emails to reportphishing@apwg.org. In the US, you can also report to the FTC at ReportFraud.ftc.gov.
- Tell your IT department if it was a work email.
If you think your device is compromised, read how to check if your phone is hacked.
Real examples
The fake delivery. Lisa received an email saying her package was on hold. The link went to “track-parcel-help.net.” She checked the real carrier website and found no problem.
The CEO scam. An office assistant received an email from the “CEO” asking for gift cards. The address was slightly misspelled. She called the CEO directly, who had not sent it.
The stolen password. Ahmed entered his email password on a fake “storage full” page. He realized the mistake, changed his password and enabled two-factor authentication before any damage occurred.
Frequently asked questions
Can opening a phishing email infect my device?
Simply opening an email is usually safe on modern email apps. The danger comes from clicking links, downloading attachments or entering information.
Do phishing emails always have spelling mistakes?
No. Many modern phishing emails are well written. Focus on the sender, links and requests instead.
How do scammers get my email address?
From data breaches, public websites, marketing lists or guessing common formats.
Should I unsubscribe from phishing emails?
No. Unsubscribe links in scam emails can confirm your address is active or lead to malicious sites. Report and delete instead.
Can AI help scammers write phishing emails?
Yes. AI can make phishing more convincing, which is why verifying through official channels is more important than ever.
How to read a link before you click
Links are the heart of most phishing attacks, so learning to read them is the most valuable skill you can build. A web address is read from the domain at the end of the first section, just before the first single slash. For example:
| Link | Real domain | Safe? |
|---|---|---|
| https://www.paypal.com/myaccount | paypal.com | Yes, official |
| https://paypal.com.account-verify.net/login | account-verify.net | No, the real domain is at the end |
| https://www.paypa1.com/login | paypa1.com (number one, not letter L) | No, look-alike |
| https://secure-paypal-login.com | secure-paypal-login.com | No, not owned by PayPal |
| https://bit.ly/3xYz12 | bit.ly (shortener) | Unknown, be cautious |
Scammers often put the brand name at the start of the address, hoping you will not read to the end. Always identify the true domain before trusting a link. On a phone, press and hold the link to preview it without opening.
Protecting yourself with technology
You do not have to rely only on your eyes. These tools add strong layers of protection:
- Password managers fill in passwords only on the correct website. If your password manager does not offer to fill your login, that is a warning sign the site may be fake.
- Passkeys replace passwords with cryptographic keys tied to the real website, making phishing much harder. Many major services, including Google, Apple, Microsoft and PayPal, support them.
- Two-factor authentication means a stolen password alone is not enough to break in.
- Email security filters from Gmail, Outlook and others block many phishing messages automatically. Report anything they miss to improve them.
- Browser safe browsing features warn you before visiting known malicious sites.
- Automatic updates patch security holes that attachments might exploit.
Teaching your family and coworkers
Phishing succeeds when even one person clicks. Share a few simple rules with your family and team: never act on urgent emails without checking through another channel, never share codes or passwords, never pay with gift cards because someone emailed you, and always ask before opening an unexpected attachment. Many workplaces run phishing awareness training and simulated phishing tests; treat them as useful practice rather than a trick.
The bottom line
To tell if an email is a phishing scam, check the sender’s real address, preview links, watch for urgency, unexpected attachments and requests for sensitive information or unusual payments. When in doubt, go directly to the company’s website or app instead of clicking. If you clicked, change passwords, enable two-factor authentication and report the email.