Phishing emails are one of the most common ways criminals try to steal passwords, personal information, and money. They’re built to look like they’re from your bank, a delivery company, your employer, or some other service you actually recognize — and they can be genuinely convincing.
The good news: most of them share a handful of telltale signs once you know what to look for. Here’s what to watch for, and exactly what to do if something looks off.
What a Phishing Email Actually Is
It’s a fraudulent message engineered to get you to do something that benefits the attacker — enter your username and password, hand over card details, share a verification code, download something malicious, open a dangerous attachment, send money, or visit a fake site. It usually borrows a real company’s name and branding to look trustworthy — think “your account has been locked, verify your information immediately,” with a link to a fake site built to steal your login.
10 Warning Signs
1. It Creates a Sense of Urgency
“Your account will be closed today.” “Immediate action required.” “You have 24 hours to respond.” Urgency is a classic pressure tactic — the goal is to make you act before you think it through. If a message makes you feel rushed, that’s exactly the moment to slow down and verify independently.
2. The Sender’s Address Looks Off
Don’t trust the display name alone — check the full email address. Watch for misspelled company names, extra characters, unfamiliar domains, random letter-number combos, or an address that just doesn’t match the organization it claims to be from. That said, a familiar-looking address isn’t a guarantee either — sender info can be spoofed.
3. It Asks for Sensitive Information
Be suspicious of any unexpected request for passwords, Social Security numbers, card details, bank info, verification codes, or security answers. Legitimate companies rarely ask for this by email — if you’re not sure, contact the organization directly through its official site or app instead of replying.
4. The Link Doesn’t Go Where It Should
A link can look legitimate while actually pointing somewhere else entirely. If your email app lets you preview a link’s destination, check it before clicking — watch for misspelled domains, odd subdomains, random characters, or a domain that has nothing to do with the company. For login links especially, it’s safer to open the official site yourself rather than following the email.
5. There’s an Unexpected Attachment
A file claiming to be an invoice, receipt, shipping notice, tax document, or job offer can be dangerous if you weren’t expecting it. A professional-looking email isn’t proof it’s safe — verify the sender and the request through another channel before opening anything you didn’t ask for.
6. Odd Spelling or Grammar
Awkward phrasing, missing words, or a misspelled company name can be a tell. But don’t lean on this alone — plenty of modern phishing is written cleanly, so perfect grammar doesn’t mean a message is safe.
7. A Generic Greeting
“Dear Customer” or “Dear Account Holder” from a company that normally uses your name is worth noticing. On its own it doesn’t prove anything, but combined with other red flags, it adds up.
8. An Unexpected Prize or Reward
“You won a gift card.” “You’ve been selected for a prize.” If you don’t remember entering anything, don’t click through or hand over personal info to “claim” it. If it sounds too good to be true, it probably is.
9. An Unusual Payment Request
Someone impersonating a manager, vendor, friend, or company asking you to buy gift cards, send crypto, wire money, change payment details, or pay a surprise invoice is a serious red flag. Verify through a separate channel — a known phone number, not the contact info in the suspicious message itself.
10. It Doesn’t Match Your Actual Activity
A delivery notice for something you never ordered. A password-reset email for an account you don’t use. A “payment failed” notice when you haven’t bought anything. These inconsistencies are worth trusting your gut on.
How to Check a Suspicious Email Safely
Don’t click the link. If you need the company’s site, type the address yourself or use a bookmark you already trust.
Check the full sender address, not just the display name.
Ask yourself the basics: Was I expecting this? Does the request actually make sense? Would this company normally ask for this by email? If the answer’s no to any of these, be cautious.
Contact the company separately — official site, official app, or a phone number you already know. Never the contact info sitting inside the suspicious email.
If You Clicked a Phishing Link
Just opened it? Close the page, don’t enter anything, and keep your browser and OS updated.
Entered your password? Change it immediately on the legitimate site — and anywhere else you reused it. Turn on two-factor authentication wherever you can.
Entered financial info? Call your bank or card issuer through their official number or app, explain what happened, and keep an eye on your account for anything unusual.
Downloaded a file? Don’t open it. Run a scan with reputable security software, keep your OS and apps updated, and consider professional help if you think malware actually got installed.
If You Replied to One
If you replied but didn’t share anything sensitive, just stop the conversation there. If you did share passwords, financial info, or verification codes, act fast — change any compromised passwords from the legitimate service and lock down additional account security right away.
Reporting Phishing Emails
Most major email providers have a built-in option — look for “Report phishing,” “Report spam,” or “Report suspicious message.” Reporting helps providers catch broader campaigns and protects other people too. If financial fraud or identity theft is involved, you may also need to report it to the relevant organization or authorities.
Protecting Yourself Going Forward
Think before clicking — urgency is a tactic, not a reason to act fast.
Use two-factor authentication so a stolen password alone isn’t enough to get in.
Keep your software updated — OS, browser, and important apps.
Use unique passwords for important accounts — a password manager makes this painless.
Verify unusual requests for money, passwords, or codes through a separate channel.
Don’t let fear drive the decision — slow down and check before you act, every time.
Phishing vs Spam
Spam is just unwanted messaging. Phishing is more dangerous — it’s specifically designed to deceive you into giving up information, money, or account access. Not all spam is phishing, but phishing does sometimes land in your spam folder — so don’t assume everything in your inbox is safe, and don’t assume everything in spam is harmless either.
FAQ
How can I tell if an email is phishing?
Watch for unexpected requests, urgent language, suspicious sender addresses, odd links, unexpected attachments, and requests for sensitive info. One sign alone isn’t proof — look at the whole picture.
Can a phishing email look completely legitimate?
Yes — some closely imitate real companies with professional design and convincing language. Always verify unexpected requests independently regardless of how polished it looks.
Should I just delete a phishing email?
Report it through your provider’s tool first if available, then delete — but don’t click any links or attachments in it.
Can just opening an email hack my computer?
Generally lower risk than clicking a malicious link or opening a bad attachment, especially with updated software — but still avoid interacting with suspicious content, and keep everything patched.
What’s the safest way to check an account notification?
Skip the email link entirely — open the service’s official site or app directly and check there.
Bottom Line
Phishing emails can look genuinely convincing, but the warning signs are consistent: urgency, odd sender addresses, unexpected links or attachments, requests for sensitive info, and unusual payment demands. When in doubt, don’t click — go to the official site or app yourself. And if you do slip up, move fast: change compromised passwords, turn on two-factor authentication, contact your bank if needed, and keep an eye on your accounts. A few seconds of caution beats a much bigger cleanup later.