How to spot a phishing email: signs, spoofing and what to do
2026-09-21
A phishing email is a message dressed up to look like it came from your bank, your email provider or a company you actually use, sent for one reason: to trick you into handing over a password, a payment detail or a one-time code. Unlike ordinary spam, which just wants your attention, a phishing email wants your credentials — and the best ones are convincing enough to fool people who consider themselves careful. Knowing what to look for turns a five-second glance into a reliable filter, before you ever click anything.
What makes an email phishing, not just spam
Ordinary spam is unwanted but honest about what it is — a marketing blast, a coupon, a newsletter you never asked for. A phishing email is dishonest by design: it impersonates a specific, trusted sender and manufactures a reason for you to act immediately, usually by clicking a link and typing in a password on a fake login page, or by replying with sensitive information directly. The subject and sender name are chosen to look identical to the real thing — "Your account will be suspended," "Unusual sign-in detected," "Invoice attached." The goal is never a sale; it's access.
How scammers fake the sender address (spoofing, explained)
The "From" name and address you see in your inbox are just text fields inside the message, and the core email protocol lets a sender write almost anything into them — there is no built-in check that the person sending a message is who the From field claims. That gap is what makes spoofing possible: an attacker's server can send a message that displays as "support@yourbank.com" without ever touching your bank's actual mail system. Serious mail providers fight this with authentication standards — SPF, DKIM and DMARC — that let a domain publish, in DNS, which servers are allowed to send on its behalf; mail that fails the check gets flagged or rejected. Coverage varies a lot between senders, though, which is the same reason a domain with no sending reputation can't reliably send mail either — authentication cuts both ways. A spoofed message that slips past these checks looks, at a glance, exactly like the real sender.
Seven signs of a phishing email
- The sender's actual address doesn't match the name. The display name might read "Amazon Support," but the address underneath is a random domain that has nothing to do with Amazon. Tap or hover on the sender name to see the real address before trusting anything else.
- A generic greeting. "Dear Customer" or "Dear User" instead of your name is common when a message was blasted to thousands of addresses a real company's system would normally personalize.
- Urgent or threatening language. "Act within 24 hours or your account will be closed" is designed to make you click before you think — legitimate account issues rarely come with a countdown.
- A link that doesn't match its text. Hover over any link (without clicking) and compare the actual URL shown at the bottom of your screen to the text or company it claims to point to. A mismatch is disqualifying on its own.
- A request for a password, code or payment detail by email. No legitimate bank, provider or service ever needs your password sent to them or typed into a link from an email — they already have secure ways to verify you.
- An unexpected attachment. An invoice, shipping label or "document" you weren't expecting, especially a .zip or .exe file, is one of the oldest malware-delivery tricks and remains one of the most effective.
- An offer too good to explain. A refund you didn't request, a prize you didn't enter for, a tax rebate out of nowhere — the promise exists purely to get you clicking before you ask why.
Why urgency and fear work
Phishing succeeds by short-circuiting the moment you'd normally pause and think. A message that threatens account suspension, a missed delivery or a fraudulent charge triggers a reflex to act now, and acting fast means skipping the checks above — reading the actual sender address, hovering over the link, asking whether this company would really contact you this way. Every sign in the list works because it's designed to survive a rushed read and fail a careful one. Slowing down by even ten seconds is, by itself, most of the defense.
What to do when you spot one
- Don't click any link or open any attachment. If you've already spotted one warning sign, there's no need to investigate further to confirm your suspicion.
- Don't reply, and don't use the email's own "unsubscribe" link. In a phishing message, that link can lead somewhere worse than a mailing list — the same caution covered in is it safe to unsubscribe from spam?
- Verify through a channel you trust, not the email itself. If the message claims to be from your bank or a service you use, open your browser and type in the address yourself, or use the official app — never a link from the email.
- Mark it as spam or phishing using your email provider's report button. This trains your filter and, at scale, helps flag the sender for everyone else too.
- If you already clicked and entered a password, change it immediately — on that account and anywhere else you reused it — and turn on two-factor authentication if you haven't already.
Does a disposable address protect you from phishing?
Only indirectly, and it's worth being honest about the limit: a phishing link is exactly as dangerous in a temporary inbox as in your real one, and a disposable address does nothing to make a malicious message safer to click — the same point made in is temp mail safe? What a throwaway address does help with is exposure: the less often your real, permanent address sits in a company's database, the fewer databases a future breach can pull it from, and a leaked address is exactly what feeds targeted phishing campaigns that reference a real company you actually use. Keeping your real inbox out of one-time signups and download gates — the core habit covered in our guide to avoiding spam — reduces how often attackers know enough about you to make a phishing attempt convincing in the first place.
The judgment call is the same no matter which inbox a message lands in: read the sender address before the subject line, and let curiosity about a surprising email lose to caution every time. For the signups and downloads that don't need your real address at all, generate a free temporary address and keep one more account out of a database that could leak later — the FAQ covers the rest of what the tool can and can't do.