How to Spot a Phishing Email: 12 Real Warning Signs

Phishing is the most common way accounts get stolen, and it does not look the way movies suggest. There is no hooded figure breaking into a server. There is an email that looks like it came from your bank, your delivery company, or your boss — and a link that takes you to a page that looks exactly like the login page you use every day. You type your password. The attacker gets it. That is the whole attack.

The good news: phishing emails give themselves away. They have to, because they are built in a hurry and aimed at thousands of people at once. Learn the signs and you can spot most of them in seconds, before you click anything.

1. The sender address is wrong

This is the first thing to check, every time. The display name can say anything — “PayPal Security”, “Your Bank”, “IT Support” — because display names are free text. The address behind it is what counts.

Open the sender details and read the domain after the @. A real message from a bank comes from the bank's own domain. A phishing message comes from something close but wrong: a misspelling, an extra word, or a free email service. support@paypa1.com is not PayPal. security@amazon-support.net is not Amazon. If the domain does not match the company exactly, stop there.

2. Urgency and threats

“Your account will be closed in 24 hours.” “Your package cannot be delivered.” “Unpaid invoice — legal action pending.” Phishing lives on urgency because urgency stops you thinking. A real company gives you time and lets you check the same information by logging in normally. A phisher needs you to act before you check.

Any email that pressures you to act immediately deserves the opposite reaction: slow down, close it, and check through the company's real app or website.

3. Generic greetings

“Dear Customer”, “Dear User”, “Hello valued member”. A company you actually do business with usually knows your name. Generic greetings are not proof of phishing on their own — some legitimate newsletters use them — but combined with any other sign on this list, they count against the message.

4. Links that do not go where they claim

Hover over a link before you click it (on a phone, press and hold). The address that appears should match the company and the page it claims to lead to. Phishing links hide behind normal-looking text: “Verify your account” pointing at a random domain, or a URL shortener hiding the destination entirely.

The rule is simple: never log in through a link in an email. If a message says there is a problem with your account, open the app or type the address yourself.

5. Unexpected attachments

An invoice you did not expect, a “shipping document”, a zip file from someone you do not know. Attachments are how phishing turns into malware. Do not open an attachment you were not expecting, even if the sender looks familiar — a compromised account can send malware to everyone in its address book.

6. Requests for credentials or payment details

Legitimate companies almost never ask for your password, a one-time code, or your card details by email. If a message asks for any of those, treat it as phishing until proven otherwise. The same goes for gift cards, wire transfers, and crypto payments — no real support team asks to be paid that way.

7. Spelling and grammar mistakes

Phishing used to be easy to spot from bad English alone. AI writing tools have made that harder — many phishing emails now read fluently. But mistakes still show up: odd phrasing, inconsistent formatting, a logo that looks slightly off, or a footer that does not match the company's real emails. Read the message once, slowly, and trust the feeling that something is off.

8. A login page that looks right but is not

Some phishing pages are near-perfect copies of the real login page. Two checks catch them. First, the address bar: the domain must be the company's real domain, letter for letter. Second, your password manager: it only offers to fill in your login on the domain it saved. If it stays silent on a page that claims to be your bank, that silence is a warning. NordPass and other password managers work the same way — the autofill only happens on the real site.

9. Too-good-to-be-true offers

You won a prize you never entered. A refund is waiting. A job offer with an unusually high salary and no interview. Free offers are bait, and the hook is always the same: click the link, enter your details, or pay a small “processing fee” to release the prize. Real prizes do not arrive by email from strangers.

10. The message does not match your history

A delivery notification for a package you never ordered. A password reset you never requested. An invoice from a company you have never used. If the message does not connect to anything you actually did, there is nothing to act on. Check the account directly if you are unsure — but never through the link in the message.

11. Unusual sender behavior

A colleague emailing at 3 a.m. asking you to buy gift cards. Your boss sending a document from a personal address. An invoice from a supplier with new bank details. Business email compromise works by impersonating someone you trust, so the check is the same: verify through a second channel. A quick message on Slack or a phone call takes a minute and stops most of these attacks cold.

12. The reply-to address is different

Check where a reply would go. Phishing emails often show a legitimate-looking sender address but set the reply-to to an address the attacker controls. If the reply-to domain does not match the sender, that is a strong signal the message is not what it claims to be.

What to do if you clicked

It happens to careful people. If you clicked a link or entered details:

1. Change the password for that account — from the real website or app, not through the email link.
2. Turn on two-factor authentication if it is not on already. Our guide to setting up two-factor authentication on every major app covers the process app by app.
3. Check the account for changes: forwarding rules in email, new devices, changed recovery options, sent messages you did not write.
4. If you entered payment details, contact your bank immediately and watch for charges.
5. Report the message as phishing in your email app, then delete it. Reporting helps the provider block the same message for other people.

Build the habit, not just the knowledge

Knowing the signs is not enough — phishing works because it catches people when they are busy. The habits that actually protect you are boring and automatic: check the sender domain, never log in through an email link, and let a password manager decide whether a site is real. Pair that with two-factor authentication everywhere it matters, and a single clicked link stops being a disaster. For the full routine, work through our cybersecurity roadmap for small business owners — most of it applies to personal accounts too.

Frequently asked questions

How can I tell if an email is phishing?

Check the sender's real domain (not the display name), hover over links to see the destination, and look for urgency, generic greetings, or requests for credentials. If in doubt, go to the company's real site or app and check there instead of clicking.

What should I do if I clicked a phishing link?

Change the password from the real website or app, turn on two-factor authentication, and check the account for changes. If you entered payment details, contact your bank right away.

Can phishing happen outside email?

Yes — as texts, direct messages, and phone calls. The same checks apply: unexpected urgency, a request for credentials or payment, and a link or number you did not ask for.

Do real companies ever ask for my password by email?

Almost never. Legitimate companies do not ask for passwords, one-time codes, or payment details by email. Treat any message that does as phishing until proven otherwise.

Does my spam filter catch all phishing emails?

No. Filters catch most phishing, but targeted messages still get through. Your own judgment is the last line of defense.

What should I do with a phishing email?

Report it as phishing in your email app, then delete it. Do not reply and do not click unsubscribe — that tells the sender your address is active.

How does a password manager help against phishing?

A password manager only fills in your login on the real domain it saved. On a fake lookalike site it will not offer to fill anything — and that silence is itself a warning that the site is not what it claims to be.