How to Spot a Phishing Email: 8 Red Flags

Phishing is still the most common way accounts get hijacked — not because the scams are clever, but because they catch people in a hurry. Slow down for ten seconds and the red flags are usually obvious.

Eight tells of a phishing email

• 1. Urgency or fear. “Your account will be closed in 24 hours.” Pressure is the scammer's main tool.
• 2. A mismatched sender. The display name says “Your Bank” but the actual address is a random domain. Always check the real address.
• 3. Links that don't match. Hover over a link — if the destination isn't the official domain, don't click.
• 4. Generic greetings. “Dear customer” from a company that knows your name is a warning sign.
• 5. Unexpected attachments. Invoices or “documents” you didn't request can carry malware.
• 6. Requests for credentials. Real services don't email you asking for your password or full card number.
• 7. Subtle misspellings. paypa1.com, amaz0n-support.com — look closely at the domain.
• 8. Too good to be true. Refunds, prizes, and inheritances you never expected.

What to do instead of clicking

If a message might be real, don't use its links. Open a new tab and navigate to the company's site yourself, or use its official app. Verifying takes seconds and removes all the risk.

Reduce how much phishing you get

The less your real address is exposed, the fewer targeted scams reach you. Keep it off public pages, use a this site for untrusted sign-ups, and report phishing so filters improve for everyone. More on shrinking your footprint in 12 email privacy tips.

What to do if you think you clicked, step by step

Maybe you tapped a link before the doubt set in, or typed into a page that now looks off. Don't panic — but move quickly and in order, so you close the window before anyone can use what they got.

1. Stop and enter nothing more. Close the tab. Don't finish the form or "verify" again — every extra field is a gift to the scammer.
2. Change the password from a known-good device. If the machine you just used might be compromised, switch to a phone or computer you trust, go to the account directly, and set a new, unique password — not a variation of the old one.
3. Turn on two-factor authentication. Then a stolen password alone won't get anyone in. An authenticator app is sturdier than SMS, but any 2FA beats none.
4. Hunt for what they left behind. Attackers often add a hidden forwarding rule, a filter that buries security alerts, or a logged-in session to keep access after the reset. Check your forwarding, filters, and active-sessions pages and remove anything you don't recognise.
5. Watch and report. Keep an eye on statements, and report it to the real company — or your bank, if a card was involved — using a number you look up yourself, never one from the message.

How to verify a suspicious message safely

Most messages aren't worth a clean-up at all if you check them before you act. The trick is to never let the email steer you:

• Go there yourself. Open a fresh tab and type the company's address, or use its official app. Reaching your account this way and seeing no alerts tells you the email was noise.
• Read the real sender domain. Look past the friendly display name to the actual address. support@account-security-check.com is not your bank, whatever the name says.
• Hover before you trust. Resting on a link (or long-pressing on mobile) shows the true destination. If the text says one site and the preview shows another, that gap is the whole scam.

None of this needs your real inbox involved. For sign-ups you don't trust, a public, receive-only address from this disposable inbox keeps the testing off your main account — though, as below, it doesn't sanitise the message itself.

Quick FAQ

Is it safe to just open a phishing email? Usually, yes — reading is far less risky than acting on it. The danger is in clicking links, opening attachments, or entering data. Modern mail clients don't run code from the body, so opening to look and then closing is normally fine.

What if I replied with information? Treat whatever you sent as compromised. If it was a password, change it everywhere you reused it and follow the steps above; if it was card or identity details, contact your bank. A reply also confirms your address is live, so expect more attempts.

Does receiving it in a temporary inbox make the links safe? No — a scam is a scam wherever it lands. A disposable address limits what a leak of that address exposes, but changes nothing about the link's destination. More on what these inboxes do and don't protect: are temporary emails safe and protecting your email from data breaches.