Learn how to spot a phishing email with 12 warning signs, annotated examples, simple header checks, and clear steps to take if you already clicked or replied.
Quick answer: To spot a phishing email, look past the display name to the real sender address, hover over every link to see where it actually leads, and treat urgency, unexpected attachments and any request for a password, code or payment as warning signs. If in doubt, contact the company through its official website or app instead.
This guide shows how to spot a phishing email using twelve warning signs, four annotated fictional examples, a plain-English look at authentication results, and what to do if you already clicked. Learning how to spot phishing emails takes a few minutes and protects you at home and at work.
What is a phishing email?
A phishing email is a message that pretends to come from someone you trust, such as a bank, a delivery company, a colleague or a government agency, to trick you into typing a password into a fake login page, opening a malicious attachment, sharing a one-time code or sending money.
If you are asking "what is phishing email" more broadly, phishing is the umbrella term for this impersonation, whether it arrives by email, text, social media or phone; see what phishing is. The US Cybersecurity and Infrastructure Security Agency notes that phishing messages are made to look like they come from someone you trust and often use urgent or emotional language (CISA).
How to spot a phishing email: 12 warning signs
No single sign proves a message is malicious, and a well-crafted phishing email may show only one or two of them. The more you notice, the more careful you should be.
1. The display name and the real address don't match
Anyone can set a display name such as "Example Bank Security". Click or tap it to reveal the full address. A message from examplebank.alerts@freemail.example is not from Example Bank.
2. The domain is a lookalike
Check the part after the @ symbol carefully. Attackers register domains that are one character off (examp1e.com instead of example.com), add words (example-support.com), or use the real brand as a subdomain of something else (example.com.account-check.example). Read the domain from the right: the registered name is the part just before the final suffix, so the last address really belongs to account-check.example. We break down these tricks in typosquatting and homoglyph domains explained.
3. Urgency, threats or fear
"Your account will be closed in 24 hours" or "Unusual sign-in detected" are designed to make you act before you think. Real organisations send time-sensitive notices too, but rarely insist you resolve them through a link in the email.
4. Links that don't go where they say
The visible text of a link and its real destination are two different things. On a computer, hover over the link without clicking and read the address that appears. On a phone, press and hold to preview it. Be wary of link shorteners and addresses that merely contain the brand name somewhere in the middle. Google's Gmail guidance recommends hovering before clicking for this reason (Google).
5. Unexpected attachments
Invoices, voicemail notifications and shipping documents are common bait. Be especially careful with .zip archives, HTML attachments that open a login page, Office files that ask you to "enable content", and password-protected files whose password is in the email. If you were not expecting a file, confirm with the sender another way.
6. Requests for passwords, codes or payment
Phishing always asks for something: your login, a one-time code, card details, a transfer or gift cards. The FTC lists requests to confirm personal or financial information, or to click a link to update payment details, among the classic signs (FTC).
7. Generic greetings
"Dear Customer" or your email address as the greeting suggests a bulk message. Targeted attacks can use your real name, though, so a personal greeting is not proof of legitimacy.
8. The reply-to address is different
Some phishing emails come from a plausible address but set a different reply-to address so your answer goes to the attacker. When you click Reply, check the address in the To field. If it switches to an unfamiliar domain or free webmail account, stop.
9. Odd formatting, spelling and branding
Blurry logos, mismatched fonts, awkward phrasing, the wrong currency or date format and broken footer links can all betray a copy. AI writing tools make polished text easy to produce, though, so good grammar alone does not mean a message is safe.
10. Offers that are too good to be true
Unexpected refunds, prizes, crypto giveaways and "unclaimed funds" are classic lures. If you did not enter a competition or request a refund, you have not won one.
11. QR codes that ask you to scan
A QR code in an email ("scan to re-verify your account") moves you to a phone, where the link is harder to inspect. The FTC advises against scanning QR codes in unexpected emails or texts, especially ones that urge you to act immediately (FTC). If you do scan one, read the previewed address before opening it.
12. A real conversation that suddenly changes direction
In thread hijacking, an attacker with access to a compromised mailbox replies inside a genuine email thread. Names, history and signature look right, but the new message suddenly asks you to open a "revised document", use new bank details or log in. When a conversation turns unexpectedly toward credentials or money, verify by phone using a number you already have. This overlaps with spear phishing.
What is a phishing email example? 4 annotated examples
The examples below are fictional, use reserved example domains, and are followed by the warning signs they contain.
Example 1: The account suspension notice
Example. From: Example Bank Security <no-reply@examplebank-secure.example>
Subject: Action required: your online banking access has been restricted
Dear Customer, we detected unusual activity on your account. To avoid permanent suspension, verify your identity within 12 hours. [Verify now] (the button points to examplebank-secure.example/login)
- Lookalike domain: examplebank-secure.example is not the bank's real domain.
- Urgency and threat: a 12-hour deadline and "permanent suspension".
- Generic greeting and a credential request on the attacker's login page.
Instead: open your banking app yourself. A real problem will show there.
Example 2: The parcel redelivery fee
Example. From: Parcel Delivery Service <tracking@parcel-redelivery.example>
Subject: Your package is on hold: unpaid fee of 1.99
We attempted to deliver your parcel but a small fee is outstanding. Pay within 48 hours or the item will be returned to sender. [Pay 1.99 now]
- Too small to question: a tiny fee lowers your guard, but the goal is your full card details.
- No tracking number or named carrier to check, plus a deadline.
Instead: check tracking on the carrier's official website, which you find yourself.
Example 3: The shared document login
Example. From: J. Rivera via File Share <share-notify@docs-share.example>
Subject: J. Rivera shared "Q3 Payroll Adjustments.pdf" with you
You have received a secure document. Sign in with your work email and password to view it. This link expires today.
- Curiosity bait: payroll documents are chosen because people want to open them.
- Login wall: Microsoft lists shared-document lures that ask for your email address and password as a typical phishing pattern (Microsoft).
- Sender domain unrelated to your organisation.
Instead: ask the colleague by chat or phone, and open the file from your own drive.
Example 4: The hijacked invoice thread
Example. From: Sam Lee <accounts@examp1e.com>
Subject: RE: Invoice 4471, October services
Hi, following up on our thread below. Please note our bank details have changed due to an audit. Kindly use the new account in the attached letter for this payment and confirm once done. Thanks, Sam
- Lookalike domain: examp1e.com uses the digit 1 in place of the letter l in the supplier's real example.com.
- Real thread history quoted underneath, a hallmark of thread hijacking.
- Changed bank details, one of the biggest red flags in business payments.
Instead: call the supplier on a number from your own records before changing any payment details.
How to check email headers and SPF, DKIM and DMARC results
Every email carries hidden technical headers. Three authentication checks in them tell you a lot:
- SPF checks whether the server that sent the message is allowed to send mail for that domain.
- DKIM checks a digital signature showing the message was signed by a domain and not altered in transit.
- DMARC checks that SPF or DKIM passed for the same domain shown in the From address, and tells receiving servers what to do when it doesn't.
In Gmail
Open the email and click the small down arrow below the sender's name. If the message is authenticated, Gmail shows a "mailed-by" line and a "signed-by" line with the domains involved. A question mark next to the sender's name means Gmail could not authenticate the message (Google). For the full headers, click the three-dot More menu next to Reply and choose Show original; the page that opens summarises the SPF, DKIM and DMARC results at the top (Google). In the Gmail Android app, tap View details, then View security details.
In Outlook
Outlook shows a question mark in the sender's photo when it cannot verify the sender with email authentication, and an underlined "via" tag when the actual sender differs from the From address (Microsoft). To read the headers in new Outlook or Outlook on the web, open the message and select More actions, then View, then View message details. In classic Outlook for Windows, open the message in its own window and select File, then Properties; the headers appear in the Internet headers box (Microsoft). Look for the line that begins Authentication-Results and the values after spf=, dkim= and dmarc=.
What the results do and don't tell you
A failure on a message claiming to come from a major brand is a strong warning, although Google and Microsoft note that some legitimate mail can fail too. A pass only proves the email came from the domain it shows, not that the domain is honest: an attacker who registers examp1e.com can pass every check. Always look at the domain itself as well. Our explainer on SPF, DKIM, DMARC and email spoofing goes deeper, and our checklist is this email legit? walks through the full verification routine.
What to do if you clicked a link or replied
Act quickly but calmly. The order below limits the damage:
- Stop interacting. Close the page, don't enter anything else and don't reply again.
- If you typed a password, change it immediately through the real website or app, and change it anywhere else you used it. Turn on multi-factor authentication if it isn't already on.
- If you shared a one-time code or approved a sign-in prompt, sign out of all sessions, then check recent activity, recovery details and mail-forwarding rules.
- If you entered card or bank details, call your bank using the number on your card or in its app and ask it to block the card.
- If you opened an attachment, the FTC advises updating your security software, running a scan and removing anything it flags (FTC).
- At work, report it right away. A fast report lets your security team block the sender and protect colleagues. Nobody should be embarrassed to report a click.
- If personal information was exposed and you are in the US, IdentityTheft.gov offers a step-by-step recovery plan.
How to report a phishing email
Reporting protects other people and gives providers the evidence they need.
- Gmail: open the message, click More next to Reply and choose Report phishing (Google).
- Outlook: select the message and choose Report, then Report phishing (Microsoft). Our guide on how to report phishing in Outlook covers each version.
- Work email: use your organisation's report button.
- United States: forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and report the attempt to the FTC at ReportFraud.ftc.gov (FTC).
- United Kingdom: forward suspicious emails to report@phishing.gov.uk, a service run by the National Cyber Security Centre (GOV.UK).
- The fake website itself: report the link to Google Safe Browsing and to Microsoft so browsers can warn other visitors.
If the email led you to a cloned login page, you can also report a phishing site through our form.
For brand owners: when your name is the bait
If customers or staff keep receiving phishing emails that use your brand, the email is only half the problem: the lure usually points to a lookalike domain or cloned login page that keeps collecting credentials until it is taken offline. Phishvoid handles those takedowns with hosting providers, registrars, Cloudflare, browser blocklists and CERTs, under one subscription and only with your written authorization. To see what is live against your brand, book a free exposure scan.
FAQ
What is a phishing email?
A phishing email is a fraudulent message that impersonates a trusted person or organisation to trick you into revealing passwords, codes or payment details, opening malware or sending money.
What is the fastest way to tell if an email is phishing?
Check the full sender address and hover over the main link. If either points to a domain that isn't the organisation's real one, treat the email as phishing and go to the official website or app yourself.
Can a phishing email come from a real address?
Yes. If an attacker takes over a real mailbox, messages come from a genuine address and pass authentication. Verify unexpected requests for money or logins another way.
Is it dangerous just to open a phishing email?
Opening a message in an up-to-date email app is generally low risk. The danger lies in clicking links, opening attachments, scanning QR codes or replying.
Should I click unsubscribe on a phishing email?
No. An unsubscribe link in a phishing email is just another link controlled by the attacker. Report the message and delete it instead.
What should I do if I entered my password on a phishing page?
Change the password through the official site immediately, change it anywhere you reused it, turn on multi-factor authentication, sign out other sessions and, at work, tell your security team straight away.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.