Spotting Phishing Emails Before You Click

What phishing is

Phishing is a message designed to trick you into doing something that helps the sender: entering a password on a fake page, opening a harmful attachment, paying a fake invoice, or sharing information. It usually arrives as email, but the same approach shows up in text messages, chat apps, social media and phone calls.

The messages range from clumsy to very convincing. Some are sent to thousands of people at once. Others are aimed at one person, using real names, projects and colleagues gathered from public sources. You cannot rely on spelling mistakes alone to spot them.

Warning signs

No single sign proves a message is fake, and a real message can have some of these features. But several together are a reason to slow down.

Pressure and urgency. “Your account will be closed in 24 hours.” “Payment needed today.” Time pressure is meant to stop you from thinking.

An unexpected request. A login you did not trigger, an invoice for something you did not order, a shared document from someone you do not know, a request to buy gift cards or change bank details.

A sender that is slightly off. The display name may look right while the actual address is different, or uses a lookalike domain with a swapped or added letter. On a phone, the address is often hidden until you tap the name.

Links that do not match. On a computer, hovering over a link usually shows the real destination. If the text says one thing and the destination is another, or the address looks like a jumble, be wary.

Unusual attachments. Be careful with unexpected files, especially compressed archives, documents asking you to “enable editing” or “enable content,” and anything you were not expecting from that sender.

A generic or odd greeting and tone. “Dear customer” from a service that normally uses your name, or wording that does not match how the supposed sender writes.

A request for credentials or codes. Legitimate services very rarely ask you to send a password or a one-time code by email, chat or phone.

Too good to be true. Prizes, refunds and surprise job offers.

Check before you act

Instead of clicking, take a different route.

1. Go to the source yourself. Open the service by typing its address or using your saved bookmark, and look for the alert there. If the problem is real, it will show up.
2. Contact the sender another way. If a coworker, boss or vendor sends a surprising request, ask by phone or in person using details you already have, not the ones in the message.
3. Look at the full address, not only the display name.
4. Check with your IT or security contact, if your workplace has one. Most would rather be asked than clean up afterward.
5. Let your password manager help. Password managers generally offer to fill a login only on the address they saved, so if yours stays silent on a page that claims to be your service, treat that as a hint.

Messages that target work

Work-related scams tend to follow patterns.

• Invoice and payment fraud: a message claiming to be from a supplier, with new bank details.
• Executive impersonation: a message that appears to come from a manager asking for an urgent favor, often with a request to keep it quiet.
• Shared document lures: a notice that someone shared a file, linking to a fake sign-in page. Knowing how legitimate sharing permissions notices look in your tools makes the fake ones stand out.
• Account alerts: a warning about suspicious activity or a full mailbox.
• Delivery and HR notices: a package problem, a policy update, a payroll change.

For anything involving money or changed payment details, a second check through a known channel is a good standing rule.

Safe responses

• Do not reply, and do not click. Even replying tells the sender your address is active.
• Report it. Use your email program’s report option or forward it to your workplace’s designated address.
• Delete it after reporting.
• Warn others if it looks like it targets your team.

Email filters can move obvious junk out of sight, but they are not perfect, so your own judgment remains the final check.

If you already clicked

Do not panic; acting quickly helps.

1. If you only clicked a link and nothing was entered, close the page. Run a security scan if your device has one.
2. If you entered a password, change it right away on the real site, from a device you trust. Change it anywhere else you used it.
3. If you opened an attachment or approved something unusual, disconnect from the network and tell your IT or security contact.
4. If money or payment details were involved, contact the relevant bank or payment provider quickly.
5. Check recent account activity and sign out of other sessions where you can.

The steps in what to do after an account is compromised cover the follow-up in more detail, and a simple incident checklist makes the response faster when it happens.

Two-factor authentication gives you a safety net, since a stolen password alone would not open the account. It is not perfect, though: some attacks try to capture the second code as well, so the main defense is still to not hand it over.

Build the habit

The most useful habit is a short pause: Was I expecting this? Does it ask me to act quickly? Can I check another way? Teams that treat reporting as normal, and never punish someone for admitting they clicked, tend to catch problems sooner.