How to Spot a Phishing Email in 30 Seconds

To spot a phishing email, check three things before you act: the sender's real address (not just the display name), where every link actually goes (hover on a computer, press and hold on a phone), and whether the message is pushing you to act fast with a threat, a deadline or a prize. If the domain isn't the company's real one, or the email wants your password, payment or personal details through a link, treat it as phishing and go to the company's website or app yourself instead.

The 8 warning signs of a phishing email

Most phishing emails use the same playbook: create panic, borrow a trusted name, keep you from checking, and get you to do something you can't undo. Look for these signs:

1. Urgency or threats. "Your account will be closed in 24 hours." "Immediate action required." Pressure is the point, because it stops you thinking.
2. A sender address that doesn't match. The name says your bank, but the address ends in something like "bank-support-alerts.com."
3. Links that go somewhere else. The text says one address, but the real destination is a different site.
4. A generic greeting. "Dear Customer" or "Dear User" from a company that knows your name.
5. A request for credentials, codes or payment. Real companies don't ask you to confirm your password or pay a fee through an email link.
6. Unexpected attachments. An "invoice," "shipping label" or "fax" you weren't expecting can carry malware.
7. Unusual payment methods. Gift cards, wire transfers and cryptocurrency are favorites because they are hard to reverse.
8. Something you didn't start. A reset you didn't request, a package you didn't order, a contest you never entered.

One sign is a reason to slow down. Two or more means verify before you do anything.

How to check the sender and spot a fake email address

The display name ("Amazon Support," "IT Helpdesk") can be set to anything. What matters is the address behind it. On a computer, click or hover over the sender's name. On a phone, tap it. Then read the domain, the part after the @.

Read the domain from right to left. The real website is the last two parts before the first single slash in a link, or after the @ in an email address:

• security@google-reset.com comes from "google-reset.com," not Google.
• accounts.google.com.evil-site.net belongs to "evil-site.net." Everything before it is decoration the scammer added.
• paypal.com.verify-account.info belongs to "verify-account.info."

Watch for lookalike characters. Scammers register domains that fool a quick glance:

• paypa1.com uses the number 1 instead of a lowercase L.
• arnazon.com uses "rn" to look like an "m."
• g00gle.com swaps zeros for the letter O.
• microsft.com drops a single letter.

If the domain isn't exactly the company's real one, nothing else about the email matters.

How to check a link without clicking it

On a computer, rest your mouse over the link without clicking. The true destination appears in a small preview, usually at the bottom of the window. On a phone, press and hold the link until a preview pops up, and don't tap "open."

If the visible text says one address and the preview shows another, that alone is a confirmed red flag. A button that says "Track your package" leading to a string of random characters is another.

The safest habit is to not use email links for anything important at all. Type the company's address yourself, use a bookmark, or open the official app. A lookalike domain can't touch you if you never click it.

The 30-second phishing check, step by step

Run any unexpected email through this before acting:

1. Check the sender's full address (5 seconds). Reveal the address behind the name and read the domain right to left.
2. Preview every link (10 seconds). Hover or long-press and compare the destination to the company's real domain.
3. Find the pressure (5 seconds). Is there a deadline, a threat or a prize? Scammers want you scared or excited.
4. Ask whether you started this (5 seconds). If you didn't request it, the email has to prove itself.
5. Verify another way (5 seconds to decide). Close the email and contact the company through the app, the number on the back of your card, or the website you type in.

A worked example

Dana gets an email on a Tuesday morning: "Your package could not be delivered. A customs fee of $3.95 is required. Pay within 48 hours or your parcel will be returned." It shows a tracking number and the logo of a major courier. She is expecting a package, so it feels plausible.

She runs the check. The sender is "info@courier-package-delivery.com," not the courier's real domain. Long-pressing the "Pay now" button shows a different site again. There's a deadline and a small fee designed to feel too minor to question. The greeting is "Dear Customer."

Instead of paying, she opens the courier's official website herself and enters the tracking number. The package is on schedule with no fee due. She reports the email as phishing in her email app and deletes it. Total time: under a minute. The real cost of paying would have been her card details, not $3.95.

What to do if you clicked a phishing link

Act quickly, and don't be embarrassed. These emails are built to fool careful people.

• If you entered a password, change it right away on the real site, and on any other account that uses the same one. Turn on two-factor authentication, ideally with an authenticator app rather than text messages.
• If you entered card or bank details, call your bank or card issuer using the number on your card, and ask them to block the card and watch for fraud.
• If you opened an attachment, disconnect from the internet, run a security scan, and update your device. Get help from a professional if anything seems wrong.
• If you shared personal information like your Social Security number, consider freezing your credit with the three major credit bureaus in the US, which is free.
• Report it. Use your email's "Report phishing" option, and tell the company being impersonated. In the US you can also report to the Federal Trade Commission.

Common mistakes that let phishing through

• Trusting the display name instead of checking the address.
• Trusting a familiar logo. Logos are easy to copy.
• Assuming polite emails are safe. Lines like "If you didn't request this, ignore this email" are there to make a fake look responsible.
• Clicking "unsubscribe" in a suspicious email. It can confirm your address is active. Use your email app's report or block option instead.
• Reusing passwords, so one fake login page gives away several accounts. A password manager fixes this and won't autofill on a lookalike domain.

Common questions

How do I find a phishing email in Outlook?

Click the sender's name to see the full address and check the domain. Hover over links to preview where they go before clicking. If it looks like phishing, use Outlook's "Report" option and choose phishing, which helps filter similar messages.

How can I avoid phishing emails in the first place?

You can't stop them all, but you can make them far less dangerous. Use your provider's spam filter and report button, keep your software updated, turn on two-factor authentication, and keep a separate email address for banking that you never use for shopping or newsletters. Then any "bank" email to your everyday inbox is an obvious fake.

How do I stop spam emails?

Mark unwanted messages as spam or junk so your provider learns from them, and block repeat senders. Unsubscribe only from companies you know you signed up with. For heavy spam, create filters that move messages with phrases like "verify your account" or "gift card" to a review folder.

Is it dangerous to just open a phishing email?

Opening an email is usually low risk on an up-to-date device. The danger comes from clicking links, opening attachments, replying, or entering information. If you're unsure, don't interact with it, and report and delete it.