To spot phishing emails, look at who really sent the message, whether it creates artificial urgency, and where its links actually lead before you click anything. Phishing is an attempt to trick you into handing over passwords, payment details or access to your device by pretending to be someone you trust.
What phishing emails are trying to do
Phishing messages usually pursue one of three goals. Some send you to a fake login page to capture your password. Others push you to open an attachment that installs malware. A third group simply asks you to act, for example by paying a fake invoice or buying gift cards. The disguise changes constantly, but the aim is always to get you to act before you think.
Messages arrive by email, text, phone calls and chat apps, and the same habits help with all of them. This guide focuses on email because it is still the most common route.
Warning signs that a message is phishing
No single sign proves a message is fake, and well-made scams avoid the obvious ones. Treat these as clues that add up.
- Pressure and urgency. Threats of closed accounts, missed deliveries or legal trouble are designed to rush you.
- A sender address that is slightly off. The display name might say a company you know while the actual address belongs to something unrelated, or swaps one letter for another.
- Generic greetings. A real service that holds your account usually knows your name, though not always.
- Unexpected attachments. Invoices, voicemails and shared documents you were not expecting deserve suspicion.
- Requests for secrets. Legitimate organisations do not ask you to send your password, full card number or login codes by email.
- Awkward wording or formatting. Errors are less common than they used to be, so a clean message is not proof of safety.
- Odd requests from people you know. A friend or boss suddenly asking for money or favours may have had their account hijacked.
Check the links without clicking
On a computer, hover your pointer over a link and read the address that appears. On a phone, press and hold the link to preview it. What matters is the real domain, which is the part just before the first single slash. An address like yourbank.example.net belongs to example.net, not to your bank, because the owner of the main domain controls everything to its left. If the domain does not match the organisation, do not proceed. Our guide to recognizing fake websites explains how to examine an address more closely.
How to spot phishing emails: a quick routine
- Pause. Urgency is the attacker’s main tool, so slow down on purpose.
- Look at the sender’s real address, not only the display name.
- Ask whether you expected it. Did you order something, request a reset or ask for this document?
- Check the links by hovering. If they look wrong, stop.
- Go to the source yourself. Open the company’s app, or type its address into your browser, and look for the same notice there.
- Verify through another channel. If a colleague or relative seems to be asking for something unusual, phone them using a number you already have.
- Report it. Most email services have a report phishing option, and many workplaces have an address for suspicious messages.
What to do if you already clicked
It happens to careful people, so do not panic or hide it. Act quickly instead.
If you entered a password
Change that password straight away on the real site, and on any other account where you used the same one. Turn on a second factor if you have not already; our explainer on two-factor authentication shows how. A unique password for each account, easier with a password manager, limits the damage when one is taken.
If you opened an attachment or installed something
Disconnect the device from the internet, run a scan with your security software, and consider asking a trusted technician for help. If it is a work device, tell your IT team immediately. Keeping up with updates reduces the chance that malware gets a foothold in the first place, which we cover in why software updates matter.
If you shared payment details
Contact your bank or card provider using the number on your card or their official website, and tell them what happened. The options available to you vary by country and provider, so ask them directly what they can do.
Habits that make phishing less effective
- Use a separate email address for newsletters and shopping, so important accounts see less junk.
- Keep your email and device software up to date.
- Avoid logging in through links in messages. Use bookmarks or the official app instead.
- Be wary of QR codes in unexpected emails or on stickers in public places, since they hide the destination.
- Talk to family and colleagues about what you have seen. Scams often target people who are less familiar with them.
You can find related guidance in the rest of our cybersecurity section.
Where to start
Next time an email asks you to do something, practise the routine above on it, even when it looks harmless. Check the sender, hover over the link and go to the website directly instead. Within a few weeks the habit becomes automatic, and that habit does more to protect you than any filter.
Frequently asked questions
Can I get phished through text messages or calls?
Yes. Phishing also arrives by text, phone call and chat apps, and the same habits apply: pause, verify through a channel you trust, and never share codes.
Is it safe to open a phishing email?
Opening the message is usually lower risk than clicking links or opening attachments, though it is best to delete or report it without interacting.
What is the quickest way to check a suspicious link?
Hover over it, or press and hold on a phone, and read the real domain. Better still, ignore the link and open the website yourself.
What should I do if I gave away my password?
Change it right away on the real site and anywhere else you used it, turn on a second factor, and watch the account for unusual activity.
