How to Spot a Phishing Email
Seven warning signs that help you pause before you click.
Phishing is an attempt to trick you into giving away a password, a payment or personal details by pretending to be someone you trust. The messages can look convincing, but they usually leave clues. Learning a few of them takes only a few minutes and can save you a lot of trouble.
1. The sender address does not match
Display names are easy to fake. Look at the actual address behind the name. A message that claims to come from your bank but arrives from a random free email address, or from a domain with a small spelling change, deserves suspicion. Letters swapped for similar-looking ones, such as a capital I in place of a lowercase l, are a common trick.
2. Urgency and threats
Messages that say your account will be closed today, or that you must act within an hour, are designed to stop you from thinking. Real organizations rarely demand instant action by email. If a message pressures you, slow down.
3. Links that lead somewhere else
On a computer, hover over a link without clicking and read the address that appears. On a phone, press and hold the link to preview it. If the address has nothing to do with the sender's real website, do not open it. When in doubt, type the website address yourself or use a bookmark.
4. Unexpected attachments
Be careful with files you did not ask for, especially those with names about invoices, delivery notices or documents that need signing. Zip files and office documents that ask you to enable macros are classic delivery methods for malware.
5. Requests for passwords or codes
A genuine service will not ask you to send your password or a one-time code by email, chat or phone call. If someone asks for a code that was just sent to your phone, it is almost certainly a scam.
6. Generic greetings and odd wording
Messages that begin with 'Dear customer' or contain strange grammar can indicate a mass-produced scam, although well-written phishing exists as well. Do not treat good spelling as proof that a message is safe.
7. Too good to be true
Surprise prizes, refunds you did not expect and job offers that pay very well for very little work are common bait. If you did not enter a contest, you did not win it.
What to do if you are unsure
Do not reply and do not click. Contact the organization using a phone number or website you already know. If the message came to a work account, report it to your IT team. If you already clicked and entered a password, change that password immediately, change it anywhere else you used it, and turn on two-step verification.
Organizations can also make phishing harder by setting up SPF, DKIM and DMARC on their domains, which we explain in a separate article. But your own attention is still the best filter.