How to Spot a Phishing Email Before You Click

How to Spot a Phishing Email Before You Click

A phishing email pretends to come from someone you trust, like your bank, a delivery company, Microsoft or your boss, to get you to click a link, open an attachment or hand over a password or payment details. They can look very convincing. The good news: almost all of them share a few warning signs you can learn to see in seconds.

The Warning Signs

The US Federal Trade Commission (FTC) and other consumer agencies list the same red flags again and again:

1. Urgency or a threat. "Your account will be closed in 24 hours", "Unusual sign-in detected", "Payment failed". Pressure is meant to stop you from thinking.
2. A request for information or payment. Real companies won't email you a link to "confirm" your password, card number or bank details.
3. A generic greeting. "Dear customer" or "Dear user" instead of your name. (A name alone doesn't prove it's real, though.)
4. An invoice or order you don't recognise. Fake bills and "your subscription renewed" messages are designed to make you click or call to cancel.
5. A sender address that doesn't match. The display name says "Microsoft", but the address is something like support@micros0ft-help.com or a free email account.
6. Links that go somewhere else. The text says one site, but the real address is different.
7. Unexpected attachments. Especially ZIP files, HTML files, or documents that ask you to "enable content" or "enable editing".
8. Offers that are too good. Refunds, prizes, gift cards or government payments you didn't expect.
9. A request to keep it secret or to use an unusual payment, such as gift cards, crypto or a wire transfer. This is a classic sign of "boss" or supplier scams.

Spelling mistakes used to be a strong sign, but many phishing emails are now well written. Don't treat good grammar as proof that an email is real.

How to Check an Email Safely

Check the real sender:

• Gmail: click the sender's name to see the full address.
• Outlook: hover over or click the name at the top of the message.

Check a link without clicking it:

• On a computer, hover over the link and read the address that appears (bottom-left of the browser, or in a small pop-up in Outlook).
• On a phone, press and hold the link to preview the address, then close the preview.
• Read the domain carefully, right to left from the first /. In paypal.com.account-verify.net/login the real site is account-verify.net, not PayPal.

Check the claim another way. The safest habit of all: don't use anything in the email. Open the company's app, or type its website address yourself, and sign in there. If there's really a problem, you'll see it. To call, use the number on your card, bill or the company's official website, never the number in the email.

Check with the person. If a colleague or family member asks for money or gift cards by email, call or message them on a number you already have.

How to Report a Phishing Email

Reporting helps your email provider block similar messages for everyone.

Gmail (web): open the email, click the three dots (More) next to Reply and choose Report phishing.

Outlook: select the email, then choose Report > Report phishing on the toolbar (in some versions it's under the three dots menu). Outlook.com and the new Outlook work the same way.

Also report it here (optional):

• US: forward the email to reportphishing@apwg.org and report it at ReportFraud.ftc.gov. Forward scam text messages to 7726 (SPAM).
• UK: forward it to report@phishing.gov.uk (the National Cyber Security Centre's reporting service).
• Work email: use your company's report button or tell your IT team, even if you didn't click. Others may have got the same email.

Then delete it.

What to Do If You Already Clicked

Don't panic. Act quickly, in this order:

1. If you typed a password, go to the real website (type the address yourself) and change it now. If you use the same password anywhere else, change those too.
2. Turn on two-step verification for that account, so a stolen password alone isn't enough.
3. If you gave card or bank details, call your bank or card issuer using the number on the back of your card and tell them.
4. If you opened an attachment or installed something, disconnect from the internet and run a full scan. Our guide on how to remove malware from Windows walks you through it.
5. Check your email settings for new forwarding rules or unknown devices signed in. Attackers who get into a mailbox often add a rule to hide replies.
6. In the US, if personal details such as your Social Security number were exposed, IdentityTheft.gov gives a step-by-step recovery plan.

If you just clicked a link and closed the page without typing anything, the risk is usually low. Still, run a quick scan and keep an eye on the account.

Habits That Stop Most Phishing

• Use a password manager. It only fills your password on the real site, so a fake login page gets nothing.
• Turn on two-step verification or passkeys for email, banking and shopping accounts.
• Keep your browser, email app and Windows up to date.
• Be extra careful on your phone, where it's harder to see the full sender address and link.
• Know the other signs of an infected PC; see top 10 signs your computer has malware.

Phishing also arrives by phone and text. The same rule applies: don't act on the message itself; contact the company through a channel you already trust. For a phone-based example, see our explainer on the call merging scam.

---

Frequently Asked Questions (FAQ)

Similar Posts : How to Secure Your Home WiFi Router, How to Fix Outlook Not Sending or Receiving Emails, How to Check if Your Email Was in a Data Breach, Windows Security Not Opening or Turned Off How to Fix It, Outlook Search Not Working How to Fix It,

See Also:phishing email security