Almost everyone with an email address has received a phishing email at some point — and most of us have come closer to falling for one than we would like to admit. Phishing emails are designed to trick you into clicking a dangerous link, opening a harmful attachment, or handing over passwords and personal details. The good news is that once you know what to look for, the vast majority of phishing attempts become easy to spot. In this guide, you will learn the seven most reliable red flags that give phishing emails away, plus exactly what to do when one lands in your inbox.
What Is a Phishing Email?
A phishing email is a fake message sent by a scammer pretending to be someone you trust — your bank, a delivery company, a government agency, a coworker, or a service like your email provider or a streaming subscription. The goal is always the same: to get you to take an action that benefits the attacker. Common goals include stealing your login credentials, installing malware on your device, or convincing you to send money or gift cards.
The name “phishing” comes from “fishing” — scammers cast a wide net with thousands of identical emails, hoping a few recipients bite. That is good news for you: because the same message goes to so many people, scammers cannot personalize them well and they make mistakes. Those mistakes are your red flags.
Red Flags 1–3: The Sender, the Urgency, and the Greeting
1. The sender’s address does not match the company
This is the single most reliable check. Your email app shows a display name, but that can say anything — what matters is the actual address underneath. A message displaying “Bank of America” might really come from secure-notice-8472@random-domain.xyz. Before reading a word, tap or hover on the sender’s name to reveal the full address.
Watch for warning signs: a free webmail service used for official-looking business, random numbers jammed into the address, strange domain endings, or a close-but-wrong domain such as support@paypaI-security.com (capital “I” instead of “L”). Legitimate companies send official mail from their own domains — if the address looks off, treat the email as suspicious.
2. It pressures you to act immediately
Phishing emails almost always create panic: “Your account will be locked in 24 hours!” “Unauthorized login detected — verify now!” This urgency is deliberate — a rushed reader will not stop to check the sender address or inspect links. Real companies do send important notices, but they do not threaten to close your account within hours and demand you click a link.
The moment an email makes you feel rushed, pause. No legitimate emergency is ever resolved by clicking a link in an unsolicited message. If it claims your bank account has a problem, close the email and log in through your bank’s app or by typing its web address yourself. A real issue will be visible there.
3. It greets you with “Dear Customer” instead of your name
Your bank or streaming service knows your name, so account-related messages from them usually use it. Bulk phishing emails often start with “Dear Customer,” “Dear User,” or just “Hello.” That alone proves nothing — some legitimate newsletters do it too — but combined with another red flag, it should raise your suspicion.
Beware the opposite trick too: some scams include your real name or phone number, bought from data breaches, to seem convincing. A message that uses your name is not automatically safe — the greeting is one clue among many, never the whole verdict.
Red Flags 4–6: Links, Requests, and Attachments
4. The links do not go where they claim to go
Before clicking any link, check where it really leads. On a computer, hover over the link and read the address that appears in the corner. On a phone, press and hold until a preview pops up. A link saying “Sign in to your account” should lead to the company’s real website — not a long, strange address full of random characters.
Be wary of shortened links in unexpected emails, and of lookalike domains with subtle changes — amaz0n.com with a zero instead of “o,” or micorsoft.com missing a letter. These are designed to fool your eyes at a glance. If you need the site, type the address yourself instead of clicking.
5. It asks for passwords, PINs, or payment details
This is a bright red line. Legitimate companies will never ask you to email your password, enter your full card number to “verify your account,” or forward a one-time code from your phone. That last one is especially dangerous: when a scammer tries to log in as you, the code goes to your phone, and they need you to hand it over. Any message asking for a verification code is almost certainly a scam.
The same applies to Social Security numbers, tax IDs, or identity documents requested by email. Real organizations collect those inside your logged-in account, never through a link in an unexpected message. If an email asks for any of them, stop and verify through a separate channel you trust.
6. It contains an unexpected attachment
Be cautious of any attachment you were not expecting — invoices, shipping labels, “updated policies,” or zip files from untrusted senders. Scammers use attachments to deliver malware: the file may look like a normal document but contain code that runs when you open it or click “Enable Content.”
Never open an attachment from an unexpected email, and never click “Enable Macros” or “Enable Editing” in an Office document that arrives by email. If someone you know sends you a file without any context, check with them through a different channel (a quick call or a separate message) before opening it — their account may have been compromised.
Red Flag 7: The Offer Is Too Good to Be True
Not all phishing is about fear — some of it is about greed and excitement. “You have won a $2,000 gift card!” “Claim your free iPhone!” “You have inherited $850,000 — reply to claim.” If you did not enter a contest, you did not win it. If a distant stranger left you a fortune, you can be sure the fortune does not exist.
These emails often ask for a small fee to release your prize, or personal details to “register” your winnings. The prize never arrives, but your money or information disappears. Rule of thumb: if an email makes you feel lucky or chosen — especially from a stranger — slow down and treat it with the same suspicion as a threatening one.
Watch for emotional manipulation in general: romance scams, fake job offers, and “help me move money” schemes all work by getting you excited or sympathetic. The feeling is the tool — when an email triggers strong emotions, think more carefully, not faster.
What to Do When You Spot a Phishing Email
Catching a phishing email is only half the job — handling it correctly is the other half. Follow these steps:
- Do not click anything. Do not click links, do not open attachments, and do not reply — replying tells the scammer your address is active.
- Report it as phishing. Most email apps have a “Report phishing” or “Report spam” option in the message menu. Use it. This helps your provider block the sender for everyone.
- Delete the message. After reporting, delete it so you or a family member do not accidentally click it later.
- If you already clicked or entered details, act fast. Change your password on the real website (typed in manually), enable two-factor authentication, check for unknown activity, and contact your bank immediately if you shared payment details.
- Warn others. If the email pretended to be from your employer, school, or a service your family uses, let them know so they can watch for it too.
How to Protect Yourself Going Forward
Spotting phishing is a skill, but you can also make your accounts harder to compromise even if a scam occasionally slips through. Start with these habits:
- Use strong, unique passwords stored in a password manager, so one stolen password never endangers your other accounts.
- Turn on two-factor authentication for email, banking, and social media, so a stolen password alone is never enough.
- Keep your devices updated. Security updates patch the holes that malware uses to get in.
- Slow down with unexpected messages everywhere. The same tricks appear in texts, social media, and phone calls — the red flags travel well.
Final Thoughts
Phishing emails look convincing at first glance but fall apart under a few seconds of inspection. Make it a habit: check the sender’s real address, hover over links before clicking, and never let urgency push you into acting. These three habits alone stop the overwhelming majority of phishing attempts. When in doubt, contact the company directly through a channel you trust instead of clicking anything in the message.
