How to Spot a Phishing Email: 9 Warning Signs
Phishing is the most common way accounts are stolen. A message pretends to come from a bank, a delivery company or a colleague and tries to get you to hand over a password, a code or money. Polished fakes can look convincing, but they usually share some of the same warning signs.
1. Urgency or threats
“Your account will be closed in 24 hours” is designed to make you act before you think. Real organisations rarely demand instant action by email.
2. A sender address that does not match
The display name may say your bank, but the actual address belongs to a random domain. Look closely for small misspellings such as “paypa1” or extra words in the domain.
3. Generic greetings
“Dear customer” suggests a mass mailing, although better scams now use your real name.
4. Links that go somewhere else
Hover over a link, or press and hold on a phone, to preview the address. If it does not match the company’s real website, do not click.
5. Unexpected attachments
Invoices, voicemail files and shared documents you were not expecting are common ways to deliver malware.
6. Requests for passwords, codes or payment
Legitimate services do not ask you to email your password or read out a verification code.
7. Odd payment methods
Gift cards, cryptocurrency and wire transfers are favourites of scammers because they are hard to reverse.
8. Pressure to keep it secret
A message telling you not to tell anyone or to skip normal checks is a major red flag.
9. Something just feels off
Unusual wording, a strange time or an out-of-character request from a colleague deserves a second look.
What to do
- Do not click or reply. Open the company’s app or type the website address yourself.
- Verify through another channel, such as calling a known number.
- Report it using your email provider’s phishing button, then delete it.
