How to spot a phishing email

8 red flags to look for

The sender address doesn't match the company. The display name may say "Bank" or "Support", but the address after the @ belongs to someone else.

It rushes you. "Within 24 hours", "your account will be closed" or "a penalty will follow" are there to stop you from thinking.

It asks for a password or a one-time code. Real companies never ask for these by email. If it asks you to pay, check by signing in yourself, not through the link.

The link goes somewhere else. The button says one company, but the address behind it is a different or misspelled site.

The greeting is generic. "Dear customer" or just "Hello" means the sender may not know who you are.

Key details are missing. There is no order number, amount, case number or contact person you can check.

Something feels off. The language changes halfway, the footer is in another language, or the logo looks copied.

You didn't expect it. A job you never applied for, a refund you never asked for, or a parcel you never ordered.

How to check a sender

Tap or hover over the sender's name to see the full address. Look at the part after the @. It should be the company's own domain, spelled exactly right.

Watch for small tricks: a swapped letter, an extra word, or a real name followed by a different domain. A free webmail address is also a warning sign for any company or official body.

A correct-looking address is not full proof, so still check the rest of the email. When in doubt, contact the company using details you find yourself.

How to check a link without clicking

On a computer, rest the mouse pointer on the link or button without clicking. The real address shows at the bottom of the window or in a small box.

On a phone, press and hold the link until a preview appears, then let go without opening it.

Find the first single slash after the start of the address. Just before it, read from right to left: the last two parts (three for endings like .co.uk), like example.net, are the real site. In "brand.example.net/login", the site is example.net, not brand.

Short links, long random names and misspelled brand names are all red flags. The safest choice is to skip the link and open the app or type the address yourself.

What to do if you clicked

Don't panic, and don't type anything more on the page. Close it.

If you entered a password, change it now from the real site or app. Change it anywhere else you used the same password, and turn on two-step sign-in.

If you shared card or bank details, call your bank on the number on your card. Ask them to block the card and watch for strange payments.

If a file downloaded, don't open it. Delete it and run a security scan.

If the email came to your work address, tell your IT team right away. Quick action limits the damage.

How to report a phishing email

Reporting helps your mail app block similar emails for you and others. Use the report option, not just delete.

Gmail: open the email, tap the three-dot menu next to Reply, and choose "Report phishing".

Outlook: select the email, open the "Report" menu on the toolbar, and choose "Report phishing".

Apple Mail: move the email to the Junk folder with the "Junk" button or menu. To warn Apple about fake Apple emails, forward them as an attachment to the report address listed on Apple's support site.

Other mail apps: look for "Report spam", "Report phishing" or "Junk" in the message menu.

You can also forward the email to the real company's abuse or security team. Find their address on the company's official website, not in the email.

Questions people ask

Can I get hacked just by opening a phishing email? Usually not. The risk comes from clicking links, opening attachments or replying. Still, don't load images or click anything, and delete the email.

Should I reply to tell them I know it's a scam? No. A reply shows your address is active, and you may get more scam emails. Just report it and delete it.

Why does the email show the real company logo and address? Logos, footers and addresses are easy to copy from a real website. They prove nothing. Check the sender address and the link instead.

The email came from my own domain. Was my account hacked? Not always. The display name and visible text are easy to fake. If you are worried, change your password from your account settings and turn on two-step sign-in.

See real examples

Our list of scam emails reported as phishing shows these red flags in real messages.