How to Spot a Phishing Email Before It Tricks You
Slow down, check the sender address, watch for urgency and threats, never click a link or open an attachment you did not expect, and verify through a separate trusted path.
A phishing email pretends to be from a bank, store, or service you use and tries to scare or tempt you into clicking a link, opening an attachment, or typing your password on a fake sign-in page. One click can hand your account to a stranger. These emails are common, but they follow predictable patterns you can learn to recognize.
- Device
- Any device that reads email
- Operating system
- All
- Difficulty
- Easy
- Approx. time
- A minute per suspicious email
- Your email inbox
- A separate, trusted way to check the real account (the official app or website you typed in yourself)
- Do not click links or open attachments in a suspicious email to “check.”
- Do not call phone numbers listed in the email — use the number from the real company website.
- If you already clicked and signed in, change that password immediately and turn on two-factor authentication.
- 1
Check the sender’s full email address, not just the display name.
- 2
Hover over any link (without clicking) to see where it actually goes.
- 1
Check the sender address. A real message from a bank comes from the bank’s domain; a fake one often uses a look-alike or random address.
Expected result — You can confirm whether the address matches the real organization.
- 2
Look for urgency or threats — “your account will be closed in 24 hours” is a classic pressure tactic designed to make you act before thinking.
Expected result — You recognize the pressure as a warning sign, not a reason to rush.
- 3
Hover over links (do not click) and read the real address in the preview. A link that says “bank.com” but points somewhere else is a trap.
Expected result — You see the true destination of each link.
- 4
Watch for generic greetings, spelling mistakes, and requests for passwords or payment — real services do not ask for passwords by email.
Expected result — You spot one or more classic phishing tells.
- 5
If you are unsure, do not use the email. Open the official app or type the website address yourself and check there.
Expected result — You verify the situation through a path you trust, separate from the email.
- You did not click any link or open any attachment from the suspicious email.
- You confirmed the real account status through the official app or website.
- 1
If you already clicked and signed in on a fake page, change that password right now and enable two-factor authentication.
- 2
If you entered payment details, contact your bank or card issuer and report the fraud.
- 1
There is nothing to undo if you did not click — just delete or report the email as phishing.
- 2
If you did click, the undo is changing the password and turning on 2FA immediately.
Phishing works by hijacking trust and urgency. The email imitates a brand you recognize and adds a deadline so you act on emotion instead of checking. The single most effective defense is to slow down and verify through a separate channel — the real app or a website you typed yourself — rather than following the email’s links.
Sender addresses and link destinations are the two facts the scammer cannot fully hide, which is why checking those first catches most phishing emails.
- Cybersecurity guidance on phishing recognition from government and industry sources, accessed September 2026.
- Originally published
- September 2026
- Last verified
- September 2026
- Written & maintained by
- Gorge Computers Editorial