Phishing emails used to be easy to laugh off, full of broken grammar and obvious lies. Today they copy real brands pixel for pixel, spoof names you trust, and arrive at the exact moment you are busy enough to click without thinking. The good news is that almost every phishing email leaves fingerprints. This guide walks through ten concrete warning signs and shows you exactly what to do when a suspicious message lands in your inbox.
1. The sender domain does not match the brand
The display name is the easiest thing in the world to fake. What matters is the actual email address after the @ symbol. A message that claims to be from PayPal but comes from service@paypal-secure-billing.com is not from PayPal. Real companies send from their own domain, not a lookalike with extra words bolted on.
Look closely for small swaps that your eye glides past: a zero instead of an O, an rn that reads as an m, or .co where you expected .com. When in doubt, compare the domain against a real email you know is legitimate.
2. Urgency and threats push you to act fast
Scammers know that a calm person checks before clicking, so they manufacture panic. "Your account will be suspended in 24 hours." "Unusual login detected, verify now." "Final notice before legal action." The whole point is to flood you with stress so you skip your normal judgment.
Legitimate companies rarely threaten you with a deadline measured in hours. If a message is engineered to make your heart race, slow down. That feeling is the attack, not the emergency.
3. A generic greeting where your name should be
A bank that holds your account knows your name. A scammer blasting ten thousand addresses does not. "Dear Customer," "Dear Account Holder," or "Hello User" are classic signs that the sender pulled your address off a list and has no real relationship with you.
This is not foolproof, since some real marketing emails are generic too, but combined with any other sign on this list it is a strong tell.
4. Unexpected attachments
You did not order anything, yet here is an "invoice.zip." You never used this service, yet a "shipping_label.docx" wants opening. Attachments are a favorite delivery method for malware because a single click can run code on your machine.
Be especially wary of file types like .zip, .exe, .scr, and Office documents that ask you to "enable macros" or "enable editing." No legitimate document needs you to disable a security feature to read it.
5. Links that do not go where they claim
The visible text of a link and its real destination can be completely different. On a computer, hover your cursor over any link without clicking and look at the address that appears in the corner of your screen. On a phone, press and hold the link to preview it.
If the email says "log in at yourbank.com" but the preview shows yourbank.com.verify-login.ru, the part right before the final domain is what counts, and here that is verify-login.ru. That is where you would actually land.
6. Requests for credentials, codes, or payment
No legitimate company will email you and ask for your password, your full card number, your Social Security number, or a one-time security code. A particularly nasty trick asks you to "confirm" the verification code they just triggered, which hands the attacker the exact key they need to break into your real account.
Treat any email that wants your secrets as hostile until proven otherwise. The same goes for sudden requests to pay by gift card, wire transfer, or cryptocurrency, which are the calling cards of scams because they are hard to reverse.
7. Offers that are too good to be true
You won a lottery you never entered. A stranger wants to share a fortune. A brand is giving away free hardware if you "just cover shipping." The promise is the bait, and the cost arrives later in stolen data or charges you never authorized.
The old rule holds: if it sounds too good to be true, it almost certainly is. Real prizes do not require you to pay or hand over banking details to claim them.
8. Spelling and grammar that feel slightly off
Polished phishing exists, but a surprising amount still reads a little wrong. Odd capitalization, missing articles, stiff phrasing, or a tone that does not match how the real brand usually writes are all quiet warnings. Some of this is deliberate, designed to filter for people who do not notice details.
Trust your gut here. If an email from a company you know suddenly sounds clumsy or robotic, that mismatch is worth a second look.
9. A spoofed brand that looks almost perfect
Attackers lift real logos, fonts, and footer text straight from genuine emails. The visual polish can be flawless, which is exactly why you cannot rely on appearance alone. Verify the parts that are hard to fake: the sending domain, the link destinations, and whether the message makes sense for your actual relationship with that company.
A real, established sender also tends to include a coherent signature with a verifiable name, role, and company details. To learn what a trustworthy footer looks like, see our guide to building a professional email address and the habits that come with it.
10. A reply-to address that does not match the sender
Some phishing emails are sent from one address but quietly set the "reply-to" field to a different one, so any response you send goes straight to the attacker. Many mail clients hide this field by default. If you can view full message headers or expand the sender details, check whether replies would go somewhere unexpected.
This trick is common in business email compromise, where a message appears to come from your boss or a vendor but routes your reply to an outsider.
What it looks like in practice
Here is a typical phishing email. Watch how many warning signs it stacks into a few short lines.
Subject: URGENT: Your account will be closed in 24 hours
Dear Customer,
We have detected unusual activity on your account. To avoid permanent suspension you must verify your details immediately by clicking the secure link below.
Verify Now: http://secure-account-verify.support-login.ru/confirm
Failure to act within 24 hours will result in account closure.
Regards, The Security Team
In four lines it hits a generic greeting, manufactured urgency, a threatened deadline, a mismatched link domain, and an anonymous signature. Now compare a legitimate notice from a real company.
Subject: New sign-in to your account from a new device
Hi Maria,
We noticed a new sign-in to your account from a Windows device in Austin. If this was you, no action is needed.
If you do not recognize this, you can review recent activity by going to our website and opening your security settings. We will never ask you to confirm your password or a verification code by email.
Thanks, Account Security, Northgate Bank
The real one uses your name, does not threaten you, tells you to navigate to the site yourself rather than clicking a link, and explicitly states it will never ask for your password. That difference in tone and structure is the tell.
A real signature versus a spoofed one
Phishing emails often fake a signature to look official, but the details rarely hold up. A genuine professional signature is consistent with the sender's domain, links to the company's real website, and matches the person's known role. A spoofed one might show a real name with a mismatched address, a link that points somewhere odd, or a logo pulled from a brand the sender does not actually represent.
A clean, consistent signature is one small signal of legitimacy among many. It is never proof on its own, but a missing or contradictory signature on a high-stakes request is one more reason to verify before you act. If your own emails go out with no signature or a messy one, you can create a free email signature so the people you write to have an easier time trusting you.
What to do when a phishing email arrives
When something feels off, work the problem in this order:
- Do not click anything. No links, no attachments, no "unsubscribe" button, which on a scam email can confirm your address is live.
- Do not reply. Engaging tells the sender a human is reading.
- Verify through a channel you already trust. Do not use the phone number or link in the email. Type the company's website address yourself, or call the number on the back of your card.
- Report it. Use your mail client's "report phishing" option, and forward workplace scams to your IT or security team. Reporting trains filters and protects everyone else on your domain.
- Delete it once it is reported.
If you clicked or entered credentials before you noticed, act fast. Change the password on the affected account and anywhere you reused it, enable two-factor authentication, and tell your bank or IT team immediately. Speed limits the damage.
Frequently Asked Questions
What is the difference between phishing and spam?
Spam is unwanted bulk email, usually advertising, that is annoying but not necessarily dangerous. Phishing is a targeted attempt to trick you into giving up information or money, often by impersonating someone you trust. All phishing is unwanted, but not all spam is phishing. Strong filters help with both, and our guide on how to avoid spam filters explains the mechanics that separate junk from legitimate mail.
Is it safe to open a phishing email?
Simply opening and reading a modern email is usually safe, since the danger lives in clicking links, opening attachments, or replying. That said, some emails try to load remote images to confirm your address is active, so many people keep image loading off by default. The safest move is to not interact with the message at all and to report it. When unsure, treat the email as if any action inside it is risky.
How can I tell if a link is safe before clicking?
Hover over the link on a computer, or press and hold it on a phone, to preview the real destination without opening it. Read the address from right to left and focus on the domain that sits just before the first single slash, because that is where you actually go. If the domain is not the official site you expected, do not click. When you genuinely need to reach a service, type its address yourself rather than trusting any link in an email.
The habit that keeps you safe
You will never memorize every trick, because attackers invent new ones constantly. What protects you is a single durable habit: slow down before you act on any email that wants your information, your money, or your urgency. Check the domain, preview the links, and verify through a channel you already trust. Following good email etiquette rules on your own messages also helps, because it trains you to notice when something does not look right. Stay a little skeptical, and the vast majority of phishing slides right past you.
