How to spot a phishing email

Phishing emails try to get you to do one of three things: enter a password on a fake page, open a file that installs something, or send money or data to someone who isn’t who they claim to be. Spelling mistakes used to give them away. Since AI writing tools became widespread, many phishing emails are fluent and well formatted, so the reliable signals are now technical and behavioural rather than grammatical.

Use the checklist below on any message that asks you to act. If something still doesn’t add up, paste the headers into the email header analyzer or check the sender’s address with the email checker.

The checklist

1. Read the real sender address, not the name

Email apps show the display name prominently and hide the address. Anyone can set the display name to “PayPal” or “IT Helpdesk”. Tap or hover over the name to see the address behind it.

• PayPal <service@paypal.com>: plausible.
• PayPal <service@paypal-resolution-center.net>: not PayPal.
• PayPal <notifications.team8812@gmail.com>: definitely not PayPal.

Large companies send from their own domain or a clearly related one. A free mailbox (Gmail, Outlook.com, Yahoo) claiming to be a bank or a company’s IT department is a red flag.

2. Look closely at the domain

Attackers register domains that look right at a glance:

To find the real domain in an address or link, read the part right before the first single slash, from right to left: the last two labels (or three for endings like .co.uk) are the domain that actually owns it.

The email checker flags punycode, mixed scripts, typos of big providers and domains registered in the last few weeks, which is a strong sign of a throwaway phishing domain.

3. Compare From and Reply-To

A message can come “from” one address and send your reply somewhere else. If you click reply and the To field shows a different address, especially a free mailbox, stop. This is the standard setup for invoice fraud and CEO scams, where the attacker never needs you to click anything; they just need you to answer.

4. Notice pressure and unusual requests

Phishing relies on making you act before you think. Typical patterns:

• Urgency: “Your account will be closed in 24 hours.”
• Fear: “Unusual sign-in detected”, “Payment failed”, “Legal action”.
• Reward: refunds, prizes, unclaimed parcels.
• Authority: a message from “the CEO” asking for a quick, confidential favour.
• Changed payment details: “Our bank account has changed, please pay the attached invoice to the new IBAN.”
• Gift cards or crypto as a payment method. No legitimate employer, government office or support team asks for them.

None of these prove phishing alone, but any request for credentials, payment or secrecy deserves a check through a separate channel.

5. Check links before clicking

On a computer, hover over a link and read the address in the corner of the window. On a phone, press and hold the link to preview it. Apply the right-to-left rule from step 2.

Be suspicious of:

• link text that shows one address while the actual link goes to another;
• URL shorteners and redirect chains in messages that claim to come from a bank or big company;
• links to shared documents (Google Docs, OneDrive, Dropbox) from people you don’t expect them from, which then ask you to “sign in to view”.

The safest habit: don’t log in through email links at all. Open the site from your bookmark or type the address yourself. If the alert is real, you will see it there too.

6. Treat attachments and QR codes with care

High-risk attachment types include .html and .htm files (often a fake login page that runs locally), .zip, .iso, .img, .exe, .js, Office files that ask you to “enable content” or macros, and password-protected archives, which scanners can’t inspect.

QR codes in emails (“scan to verify your MFA”) are popular with attackers because they move you from a protected work laptop to a personal phone, where the link is harder to inspect. Treat a QR code like any other link.

7. Check the authentication results in the headers

Your mail provider records whether the message passed SPF, DKIM and DMARC, the three checks that show whether a message really came from the domain in the From address. Look for the Authentication-Results header:

Authentication-Results: mx.google.com;
  spf=fail smtp.mailfrom=paypal.com;
  dkim=none;
  dmarc=fail (p=REJECT) header.from=paypal.com

A DMARC fail for a domain like paypal.com means the message did not come from PayPal’s servers. The email header analyzer reads these results for you, compares From, Reply-To and Return-Path, and lists the servers the message passed through, with their IP addresses.

The opposite does not hold: passing all three only proves the message came from that domain. A phisher sending from their own secure-paypal-billing.com can pass every check. Authentication tells you who sent it; steps 1 to 6 tell you whether to trust them. For the background, see SPF, DKIM and DMARC explained.

8. Verify through a channel you already trust

When in doubt, contact the sender in a way that doesn’t come from the email: the phone number on your card or contract, the official app, the website typed by hand, or a colleague in person or on your usual chat. This one habit defeats almost every phishing attempt, including well-crafted ones.

Worked example

A message arrives with the subject “Action required: mailbox storage full”.

Five independent signals point the same way. Delete it and report it.

What to do if you clicked

Act quickly; minutes matter with stolen passwords.

1. Entered a password? Change it immediately from a device you trust, and anywhere else you reused it. Then turn on two-factor authentication, preferably an authenticator app or passkey rather than SMS.
2. Sign out other sessions. Most services (Google, Microsoft, Apple, social networks) let you end all active sessions from the security settings.
3. Gave card or bank details? Call your bank on the number printed on your card and block the card.
4. Opened an attachment? Disconnect the device from the network and run a full scan. At work, tell IT straight away; they would much rather hear early.
5. Check mailbox rules. Attackers who get into an email account often add a forwarding rule or filter to hide replies. Look for rules you didn’t create.

How to report it

• Gmail: open the message, three-dot menu → Report phishing.
• Outlook: Report → Report phishing.
• At work: use the “Report” button or forward to your security team.
• You can also forward phishing to the Anti-Phishing Working Group at reportphishing@apwg.org, and in the UK to the NCSC at report@phishing.gov.uk.

Reporting helps filters block the same campaign for other people.

In short

• Read the sender address and the real domain, right to left.
• Hover before you click, and log in only through your bookmarks.
• Pressure, payment changes and secrecy are the biggest tells.
• SPF, DKIM and DMARC catch spoofed domains, not look-alike ones.
• When unsure, verify through a channel you already trust.