Phishing attacks now account for more than 90 percent of successful data breaches, and the emails behind them have never looked more convincing. Attackers clone brand logos, spoof sender names, and use AI to craft flawless prose — making it harder than ever to tell a real message from a fake at a glance.
The good news is that even the most polished phishing email almost always contains at least one telltale flaw. Knowing where to look takes about 30 seconds per suspicious message — and those 30 seconds can stop you from handing over your passwords, banking details, or full identity to a stranger.
Quick Answer
Check four things before acting on a suspicious email: (1) does the sender’s actual address match the company’s real domain? (2) hover over every link — does the real URL match the brand? (3) is the message creating urgency or threats? (4) does it ask for passwords or personal data? If anything looks off, don’t click.
5 Warning Signs Every Phishing Email Contains
1. The Sender Address Doesn’t Match the Brand
The display name in your inbox (“PayPal Support”) can say anything — it’s the actual email address behind it that matters. Click the sender name to expand the full address. A real PayPal email comes from @paypal.com, not @paypal-secure-account.net or @paypa1.com (the digit “1” swapped for the letter “l”). Misspelled domains and unrelated TLDs like .ru or .xyz appended to a brand name are immediate red flags.
Pro tip: On a phone, press and hold the sender name for a second to reveal the full email address without digging through Settings.
2. Urgent or Threatening Language
“Your account has been suspended — verify now or lose access within 24 hours.” Phishing emails manufacture urgency because panic makes people skip checks they’d normally run. Legitimate banks, government agencies, and tech companies almost never demand immediate action via email. If a message feels like it’s rushing you, slow down instead.
3. Links That Don’t Go Where They Claim
Hover over any link before clicking (desktop) or long-press it (mobile) to preview the actual destination URL. A real Microsoft link looks like account.microsoft.com — not microsoft-account-verify.com or a bit.ly URL that hides the destination entirely. Even one character off in the domain can redirect you to a lookalike page that captures your password.
Troubleshooting tip: If you can’t safely preview the URL, paste the link (without clicking it) into VirusTotal. It scans the address against 90+ security engines in seconds — free, no account required.
4. Generic Greetings and Awkward Phrasing
“Dear Valued Customer” instead of your name signals a bulk send. Real services you have accounts with know who you are. Watch also for slightly off phrasing — sentences that technically make sense but feel machine-translated, or inconsistent fonts that suggest content copied and pasted from multiple sources.
5. Unexpected Attachments or Requests for Credentials
No legitimate company emails you an unexpected attachment and asks you to open it to “verify your identity.” Real password-reset emails contain a link to a form on their own site — they never ask you to reply with your current password. Any message requesting credentials, a Social Security number, or banking details in the reply is a phishing attempt, without exception.
Types of Phishing Attacks to Know
| Type | Delivery | Common Lure | Key Giveaway |
|---|---|---|---|
| Email phishing | Account suspension, delivery notice | Mismatched sender domain | |
| Spear phishing | Email (targeted) | Uses your name, employer, or real contacts | Specific personal detail paired with urgent request |
| Smishing | SMS/text | Package tracking, bank alert | Short link hides the real destination |
| Vishing | Phone call | Tech support, IRS, “your account” | Asks you to install software or pay in gift cards |
| Clone phishing | Resent “updated” version of a real email | Link destination changed from the original |
What to Do If You Clicked a Phishing Link
Act quickly — the first few minutes matter most.
- Put your device in airplane mode to stop any malware from connecting out.
- Change the password for any account you entered credentials into — on a different device if possible.
- Enable two-factor authentication on that account immediately. Our guide on setting up 2FA on your most important accounts walks through Google, Microsoft, and more.
- Run a malware scan using Windows Defender or Malwarebytes Free.
- Check whether your credentials appeared in a known breach using the steps in our data breach check guide.
- Report the email: in Gmail, click the three-dot menu → Report phishing; in Outlook, use Report → Phishing.
If you believe your email account itself was taken over, follow the recovery checklist in 7 Signs Your Email Account Has Been Hacked — and How to Recover It.
Common Mistakes to Avoid
- Trusting the display name alone. Always expand the full sender address — display names are completely customizable by attackers and prove nothing.
- Clicking “Unsubscribe” in a suspicious email. On a genuine phishing email, that link confirms your address is active and may trigger a malicious download.
- Assuming the padlock icon means the site is safe. HTTPS only encrypts the connection — it says nothing about whether the site itself is legitimate or run by criminals.
- Reporting before changing your password. If you entered credentials, change them first, then report — every minute counts during account recovery.
- Relying entirely on your spam filter. Targeted spear-phishing emails are crafted to bypass filters. The 30-second manual check remains your most reliable defense.
Frequently Asked Questions
Can phishing emails look exactly like the real thing?
Yes. Attackers copy entire HTML email templates — logos, formatting, and legal footers included. The tell is always in the sender domain and the link destinations, not the visual design.
What should I do with a phishing email I didn’t click?
Report it (Gmail: three-dot menu → Report phishing; Outlook: Report → Phishing), then delete it. Do not reply — even saying “wrong address” confirms your inbox is active to the attacker.
Do phishing emails only target passwords?
No. Some install malware via attachments; others harvest credit-card numbers, tax IDs, or identity documents. The method varies, but the hook — a reason to act without thinking — is always the same.
Is it safe to open a phishing email without clicking anything?
Modern email clients render messages in a sandboxed view, so simply opening the email rarely causes harm. The risk comes from clicking links or downloading and opening attachments.
How do I report phishing to authorities?
Forward the email to the Anti-Phishing Working Group at reportphishing@apwg.org and file a report with the FTC at consumer.ftc.gov. The company being impersonated will also have its own abuse or security reporting channel.
Will antivirus software catch phishing emails automatically?
Security tools block many attempts, but targeted attacks frequently slip through. Treat them as a backstop — the manual sender-and-link check is your first line of defense, not a last resort.
Conclusion
Phishing emails rely on speed and panic — two things you can neutralize by building a 30-second habit of checking sender addresses and previewing links before you act. The more automatic that routine becomes, the harder it is for any attacker to catch you off guard.
Share this guide with someone who’s ever forwarded you a “is this legit?” email. A five-minute read could save them from a very bad day.