Cybersecurity
How to Spot a Phishing Email
Most phishing emails give themselves away if you know where to look — but the clues have changed. Grammar mistakes are no longer a reliable sign, and a padlock icon proves nothing. This guide covers the ten checks that still work, in the order you should use them, plus the one habit that catches even a perfect-looking fake.
Try the tools: Phishing Spotter Quiz · Pause Before You Click Checklist
Note. The checks below take less than a minute together. The fastest single check is this: never log in or pay through a link in an unexpected email. Go to the real app or type the address yourself. That one habit defeats phishing even when every other sign is hidden.
Check 1: was it expected?
Start with the simplest question: were you expecting this message? An email about a parcel you never ordered, a refund from a service you do not use, a password reset you did not request, or a document from a colleague you have never heard of should raise suspicion immediately — even if it looks perfect. Attackers send millions of messages and rely on a small fraction matching a real situation in the victim's life.
This check also catches spear phishing, where the message is tailored to you. An email that mentions a real project, a real supplier or a real colleague is still worth verifying if it asks you to do something unusual, especially moving money or sharing credentials. Expectation is a filter, not a verdict — an unexpected message is not automatically a scam, but it always deserves a second look.
Check 2: the sender address, not the name
The display name in your inbox is easy to fake — anyone can send email labelled as your bank. What matters is the full sender address. Tap or hover over the name to see it. A genuine message from a bank comes from that bank's real domain; a phishing message comes from a lookalike — an extra letter, a swapped letter, a different ending, or a free email service pretending to be a company.
Watch for these patterns: a domain that is almost right, such as a bank name with an extra word or a misspelling; a sender using a public email service for a message that claims to come from a large organisation; and reply-to addresses that do not match the sender at all. Some attacks spoof the real domain, so a correct-looking address is reassuring but not proof — keep checking.
- Display names are free to fake — always inspect the full address.
- Lookalike domains swap, add or drop a single letter.
- A company email should come from the company domain, not a free mailbox.
Check 3: urgency and threats
Phishing emails manufacture urgency: your account closes today, your parcel will be returned, legal action starts tomorrow, your password expires in an hour. Real organisations do send reminders, but they rarely demand immediate action in a single email, and they do not threaten to lock you out if you do not click now.
Urgency is a deliberate tactic. It pushes you to act before you think, which is exactly when the other checks get skipped. If a message makes your stomach tighten, treat that feeling as information: pause, and verify through a separate channel. A genuine problem will still be there in five minutes; a scam relies on you not taking those five minutes.
Check 4: the link goes where it says
Hover over a link — on a phone, press and hold it — before tapping. The preview shows the real destination. A link whose text says your bank's website but points to an unrelated domain, a shortened link, or a long address full of random characters is a red flag. Legitimate emails link to the organisation's own domain.
Be careful with buttons too. A big friendly button hides its destination until you hover, which is why attackers love them. If you need to act, do not use the button: open the official app or type the address yourself. The same applies to links in invoices, delivery notices and password-reset messages you did not ask for.
Check 5: attachments and requests
Unexpected attachments are one of the oldest phishing tools. Be wary of invoices, delivery notes, scanned documents or voice messages you did not expect, especially if opening them asks you to enable macros, enable content, or run a program. Legitimate senders rarely send a document that needs you to lower your security to read it.
Also watch what the email asks for. No bank, government department or reputable service asks for your full password, your one-time code, or your complete card details by email. Any message that does is either a scam or a spectacular failure of security practice — either way, do not comply. If a genuine-looking message asks for something sensitive, contact the organisation through a channel you trust and ask.
Check 6: tone, detail and consistency
Good phishing often sounds right, but small inconsistencies still appear. Does the email address you by your full name, a generic greeting, or not at all? Does it mention details that do not match your account — a wrong order number, a service you cancelled, a town you never lived in? Does the branding look slightly off — a stretched logo, unusual colours, a footer with a different company name?
One more consistency check: does the message match how this organisation normally contacts you? If your bank always texts you about payments but suddenly emails a payment link, that change of channel is itself a signal. Attackers copy layouts; they are less good at copying habits.
Myths that no longer protect you
Three old pieces of advice need retiring. First, bad grammar is no longer a reliable sign — modern phishing is often well written, and some of it is produced with automated writing tools. A clean, professional email can still be a scam. Second, the padlock icon in your browser only means the connection is encrypted; it says nothing about whether the site is honest. Phishing sites routinely use encryption too.
Third, seeing the brand's logo proves nothing. Logos are copied in seconds. What protects you is not the look of a message but the channel you use to respond: the app you already have, the number on the official website, the address you type yourself. Those checks cannot be faked by a good-looking email.
- Good grammar no longer means a message is genuine.
- A padlock means the connection is encrypted, not that the site is honest.
- A copied logo proves nothing — verify through a separate channel.
A 60-second routine for every suspicious email
Put the checks together into a routine you can use without thinking. Step one: pause and ask whether the message was expected. Step two: inspect the sender's full address. Step three: hover over links and do not tap them. Step four: ask whether the message creates urgency or asks for something sensitive. Step five: verify through a different channel — the app, the official website, or a phone number you already have.
If any step fails, stop and report the message instead of acting on it. In the UK, forward it to report@phishing.gov.uk. In the US, report it to the FBI Internet Crime Complaint Center at ic3.gov. Your email provider also has a report-phishing option, usually in the same menu as spam. Reporting takes a minute and helps take the malicious site down.
If you have already clicked or entered details, do not wait to see what happens — our guide on what to do if you clicked a phishing link walks through the triage step by step, starting with changing the password from the real site or app.
Sources
- National Cyber Security Centre (UK) — Phishing guidance — last checked 14 November 2026.
- Federal Trade Commission — How to recognise phishing — last checked 14 November 2026.
- CISA — Cybersecurity best practices — last checked 14 November 2026.
Last checked: 14 November 2026.
Frequently asked questions
What is the first sign of a phishing email?
An unexpected request combined with urgency. An email you did not expect, asking you to click a link or share details right now, deserves a careful check — starting with the sender's full address and the real destination of any link.
Can a phishing email look exactly like a real one?
Very nearly. Attackers copy logos, layouts and wording, and modern phishing is often well written. That is why the strongest check is not the look of the message but verifying through a separate channel — the official app or a number you already trust.
Does a padlock icon mean an email link is safe?
No. The padlock only means the connection between your browser and the site is encrypted. Phishing sites use encryption too, so a padlock says nothing about whether the people behind the site are honest.
Should I reply to a suspicious email to check it?
No. Do not reply, do not click unsubscribe, and do not call a number in the message. Replying confirms your address is active. Verify through the organisation's official website or app instead.
What is the difference between phishing and a scam email?
Phishing is a type of scam email that impersonates a trusted organisation to steal information or money. Other scam emails, such as fake lotteries or advance-fee fraud, do not impersonate anyone — but the same rule applies: verify through a separate channel before you act.