How to Spot a Phishing Email Before You Click Anything

An email lands at 4:55 on a Friday saying your Microsoft 365 password expires in two hours, with a blue button to keep it. Or it is a parcel company asking for 1.99 to release a delivery, or your bank flagging a payment you did not make. Learning to spot a phishing email in the first thirty seconds is the cheapest security upgrade you will ever make, because almost every account takeover I have helped people clean up started with one click on a message like these.

The bad news is that the old warning signs no longer work as well as they used to. The good news is that a short, repeatable check catches nearly everything, and it does not require any technical knowledge.

Why Typos Are No Longer the Giveaway

For years the standard advice was to look for bad grammar, odd spelling and clumsy formatting. That advice is now out of date, and leaning on it can make you more vulnerable, not less.

Attackers now use translation tools and AI writing assistants that produce clean, natural English. They copy real email templates from the companies they impersonate, logos and footer links included. A phishing email from a fake courier can look pixel-for-pixel identical to a genuine one. If your mental checklist is "it looked professional, so it was fine", you will miss the well-made ones, which are exactly the ones that work.

Instead of judging how polished a message looks, judge what it is asking you to do and where it is trying to send you. Those two things cannot be faked as easily.

How to Spot a Phishing Email in Five Checks

Run through these in order. Most suspicious messages fail by the second or third step.

1. Is it pushing you to act fast?

Urgency is the engine of almost every phishing attempt: "within 24 hours", "account suspended", "final notice". Real companies do send deadline reminders, but they rarely threaten to lock you out in two hours. A tight deadline is a signal to slow down, not speed up.

2. Who actually sent it?

Ignore the display name, which anyone can set to "PayPal Support". Tap or hover over it to see the real address. Look closely at everything after the @ sign. Watch for lookalikes such as paypa1-secure.com, micros0ft-account.net or a legitimate brand name tacked onto a random domain, like amazon.order-help.info. The part just before .com.net or the country ending is the real owner.

3. Where does the link really go?

On a computer, hover the mouse over the button without clicking and read the address that appears in the bottom corner of your screen. On a phone, press and hold the link to preview it. If the address does not match the company's real website, stop there. Shortened links and long strings of random characters are also reasons to be careful.

4. What is it asking for?

Requests to "verify" your password, enter card details, scan a QR code, approve a login prompt you did not start, or open an attachment to view an "invoice" are all high-risk. Legitimate services almost never ask you to type a password from an email link.

5. Were you expecting it?

A delivery notice when you ordered nothing, a refund you did not request, a shared document from a colleague who never shares files with you. Unexpected messages deserve extra scrutiny even when everything else looks right.

Common Phishing Emails You Will See This Year

That last one deserves a mention. Some phishing emails contain no link at all, only a phone number. The goal is to get you on a call with a "support agent" who then talks you into installing remote access software. Treat any unexpected number in an email as untrusted.

What to Do Instead of Clicking

The safest habit is boring and effective: never use the link in the email. If you think the message might be real, open a new browser tab and type the company's address yourself, or open their official app. If there is genuinely a problem with your account, you will see it there.

For messages at work, forward suspicious emails to your IT team or use the "Report phishing" button in Outlook or Gmail. Reporting helps filters catch the same campaign for everyone else, and it takes five seconds.

Turning on two-factor authentication adds a backstop for the day you do slip up. Even if someone captures your password, they still need the second step. If you have been putting it off, this guide to setting up two-factor authentication without locking yourself out walks through it account by account.

If You Already Clicked

It happens to careful people. What matters is how fast you respond.

1. Do not enter anything else. Close the page immediately if you have not yet typed a password.
2. If you entered a password, change it right away from the real website, and change it anywhere else you reused it.
3. If you entered card details, call the number on the back of your card and ask to block it.
4. If you opened an attachment or installed something, disconnect from the internet and run a full scan with your antivirus.
5. Check your account activity for new forwarding rules, logins from unfamiliar locations, or added recovery emails.

Phishing also shows up on public networks through fake login portals at cafes and airports, so the habits in securing your phone before you use public Wi-Fi are worth adding to the same routine. A VPN will not save you from a phishing page, which is one of the points covered in what VPNs actually protect you from.

FAQ

Can you get hacked just by opening a phishing email?

Opening and reading an email is very low risk on an up-to-date phone or computer. The danger comes from clicking links, opening attachments, or replying with information. Keep your email app and operating system updated to close the rare exceptions.

Should I reply to a phishing email to tell them off?

No. Replying confirms your address is active and watched, which usually leads to more phishing. Report it, delete it and move on.

Does the padlock icon mean a login page is safe?

No. The padlock only means the connection is encrypted. Phishing sites routinely use HTTPS too. Always check the domain name itself rather than relying on the padlock.

How do I report a phishing email?

Use the built-in "Report phishing" option in Gmail or Outlook, and forward work-related ones to your IT team. Many countries also run a national reporting address for scams, which you can find on your government's cybersecurity website.