How to Spot a Phishing Email Before You Click Anything

How to Spot a Phishing Email Before You Click Anything

Phishing emails get harder to spot every year. The spelling mistakes are gone, the logos look right, and the messages arrive about things you actually use: a package delivery, a password reset, a bank alert, an invoice from a client. But they still leave clues, and five quick checks catch most of them in under a minute. Learning to spot a phishing email is one of the most useful skills on the internet, because the email is how most account takeovers start.

The stakes are real. The Gnosis Pay breach we covered this week started with unauthorized access to a live system, and the October breach wave showed the same five mistakes repeating at national scale. Phishing is the front door for a large share of those incidents. The attacker does not need to break your password if you hand it over yourself.

Check 1: The Sender Address, Not the Display Name

The display name is free. Anyone can send an email that says it is from your bank, your boss, or a delivery company. The actual address is the part that matters, and it is the first thing to check.

Hover over or tap the sender name to reveal the real address. Look for misspellings, extra words, and wrong domains: [email protected] instead of paypal.com, or [email protected] instead of amazon.com. A legitimate company sends from its own domain. If the address is a Gmail account claiming to be your bank, or a long string of random characters, stop there. That is your answer.

Also check the reply-to address, which can differ from the sender. If an email claims to be from a company but replies go to a personal inbox, that is a strong signal something is wrong.

Check 2: The Link Destination, Not the Link Text

A phishing email wants you to click, and the link is where the trap is. The text can say anything: Verify Your Account, Track Your Package, View Invoice. The destination is what counts.

Hover over the link before clicking, or long-press it on your phone to preview the destination. If the text says your bank's website but the link points to a different domain, a URL shortener, or an IP address, do not click. The safest move is to ignore the link entirely and go to the site yourself by typing the address or opening the app. If there is a real problem with your account, it will be visible there too.

This is the check that matters most, and it takes two seconds. Make it a habit, and most phishing emails fail at this step.

Check 3: Urgency Is a Tactic, Not a Fact

Phishing emails manufacture urgency. Your account will be closed in 24 hours. Your package will be returned. Suspicious activity was detected. Verify now or lose access. The urgency is the point: it pushes you to act before you think.

Real companies do send urgent messages, but they do not threaten to delete your account in a day over email, and they do not demand that you click a link right now. When an email makes your heart rate go up, treat that as a warning sign, not a reason to hurry. Slow down, check the sender, check the link, and if you are still unsure, contact the company through its official website or app, not through any contact details in the email.

Check 4: Attachments and Requests for Sensitive Information

Be suspicious of unexpected attachments, especially zip files, Office documents with macros, and anything you were not expecting. A shipping company does not need to send you an invoice as a zip file. If you were not expecting an attachment, do not open it.

Equally important is what the email asks for. No legitimate company will ask you to email your password, your full card number, or a verification code. If an email asks for any of those, it is a scam, full stop. And if you already use a password manager, remember that passkeys are going mainstream precisely because they cannot be phished the way passwords can.

Check 5: The Details That Do Not Add Up

Read the email once, slowly, and look for the small things. A generic greeting like Dear Customer when the company normally uses your name. A logo that looks slightly off, or formatting that does not match the company's usual emails. A request that does not match anything you did recently: a password reset you never asked for, a delivery for something you never ordered, an invoice from a company you never used.

None of these details proves an email is fake on its own. Together, they build a picture. Two or more red flags means you should treat the email as hostile until proven otherwise.

What to Do If You Already Clicked

If you clicked a link or entered credentials on a suspicious page, act fast. Change the password for that account immediately, from the real site, not from the email. Turn on two-factor authentication if it is not already on. Check the account for changes you did not make, like a new email address or forwarding rule. And if the account is financial, watch your statements for the next few weeks.

Then report the email. Most email apps have a Report Phishing option, and reporting helps the filters catch the next copy. If you think your data was exposed, check if your data was leaked and follow the first-hour checklist in our breach guide.

The goal is not paranoia. It is a habit: sender, link, urgency, attachment, details. Five checks, under a minute, and most phishing emails never get past the first one.