What phishing is
Phishing emails pretend to be from a bank, a delivery company, your employer, or a service you use, and try to get you to hand over passwords, payment details, or access to your computer. The emails keep getting more convincing, but they still share telltale signs. Learn the signs once and you will spot most of them in seconds.
The 7 red flags
- Urgency and threats. "Your account will be closed in 24 hours" or "unusual activity detected, verify now." Legitimate companies rarely threaten you by email.
- The sender address is wrong. The display name may say your bank, but the actual address is something like [email protected]. Always expand the sender field and read the full address.
- Generic greetings. "Dear customer" or "Dear user" instead of your name. Real services you have accounts with normally use your name.
- Links that do not match. Hover over a link (or long-press on a phone) to preview the real destination before tapping. If the text says your bank but the preview points elsewhere, it is a scam.
- Unexpected attachments. Invoices, shipping labels, or "documents" you did not ask for often carry malware. Do not open them.
- Too good to be true. Refunds you never requested, prizes you never entered, and job offers with no interview are bait.
- Odd language. Awkward phrasing and spelling errors still appear, though AI-written scams are making this flag less reliable than it used to be.
What to do with a suspicious email
- Do not click, do not reply, do not download. Even replying confirms your address is active.
- Verify independently. Open your bank's app or type the company's address yourself. Never use the phone number or link in the suspicious email.
- Report it. In Gmail, open the message and click Report phishing. You can also forward phishing emails to the Anti-Phishing Working Group and report scams to your country's consumer protection agency.
- Delete it after reporting.
If you already clicked or entered details
- Change the password for that account immediately, from a clean device, and anywhere else you reused it.
- Turn on two-factor authentication on the account if it was not on.
- Check for damage: review recent transactions, sent emails, and account recovery settings the attacker may have changed.
- Run a malware scan if you downloaded an attachment or installed anything.
- If you entered payment details, call your bank and consider freezing your credit.
Build habits that make phishing fail
- Bookmark your bank and key services and always go through the bookmark, never email links.
- Use a password manager: it will not autofill your credentials on a fake lookalike site, which quietly warns you.
- Prefer passkeys where offered: there is no password for a scammer to steal.
- Slow down. Nearly every successful phish works because the victim acted before thinking.