How to Spot a Phishing Email: 9 Checks Before You Click

Phishing is a message that pretends to come from someone you trust so that you hand over a password, payment or personal information. It remains one of the most common ways accounts and businesses are compromised, because it targets people rather than software. The good news: most phishing attempts fail at least one of the checks below.

1. Look at the actual sender address

Display names are easy to fake. Tap or hover over the sender name and read the full address. Watch for small misspellings, extra words (support-yourbank-secure.com) and free webmail accounts claiming to be a company.

2. Notice manufactured urgency

"Your account will be closed in 24 hours", "Unusual activity detected", "Final notice". Pressure is the attacker's main tool because it stops you checking. Real organisations rarely demand action within minutes.

3. Check where links really go

On a computer, hover over a link and read the address that appears at the bottom of the browser. On a phone, press and hold the link to preview it. The part that matters is the domain just before the first single slash. In https://login.example.com.account-check.net/, the real domain is account-check.net, not example.com.

4. Be suspicious of unexpected attachments

Invoices you were not expecting, "scanned documents", and files that ask you to "enable editing" or "enable content" deserve extra caution. Office files with macros, compressed archives and HTML attachments are common carriers.

5. Question any request to change payment details

Business email compromise often looks like a normal message from a supplier: "We have changed banks, please use the new account below." Always confirm bank-detail changes by phoning a number you already have on file, never one given in the email.

6. Treat requests for codes and passwords as a red flag

No legitimate bank, delivery company or IT department needs your password or the one-time code sent to your phone. Anyone asking for them is attempting to take over the account.

7. Check whether the greeting and details fit

Generic greetings, an order number for something you never bought, or a delivery notice when you are not expecting a parcel are all clues. Modern phishing can be well written, so do not rely on spelling mistakes alone.

8. Be wary of a switch of channel

Scams increasingly move between email, text messages, messaging apps and phone calls. A text saying "reply to this email" or a call that follows up on a suspicious email is a pattern, not a coincidence.

9. When in doubt, go direct

Do not use the link or phone number in the message. Open the app, type the website address yourself, or call the number on the back of your card. If the problem is real, you will see it there.

What to do if you already clicked

1. If you entered a password, change it immediately on the real website, plus any other account where you used the same password.
2. Turn on two-factor authentication if it was not already on. Our guide to setting up 2FA shows how.
3. If you shared card or bank details, call your bank using the number on its official website or your card.
4. If you opened an attachment on a work device, tell your IT contact straight away. Fast reporting limits damage; nobody should be blamed for reporting quickly.
5. Report the message. Use the "report phishing" option in your email app, and your national reporting service where one exists. The U.S. Federal Trade Commission's guide to recognising and avoiding phishing scams lists reporting routes and further examples.

Reduce the damage phishing can do

• Use a password manager: it will not autofill your password on a fake domain, which is a useful warning in itself.
• Prefer passkeys where offered, since they cannot be typed into a fake page.
• Keep software updated so a malicious attachment has fewer weaknesses to exploit.

The one-minute version

Check the sender, distrust urgency, preview the link, never share codes, and confirm anything involving money through a channel you already trust.