In short. A phishing email pretends to come from your bank, your email provider, a shop or someone you know. Its goal: to get you to follow a link and enter your password, open an attachment, or send money or data. It almost always gives itself away through urgency, a request for data, and an address that only looks like the real one.
Signs of phishing
- Urgency and pressure. “Your account will be locked in 24 hours”, “suspicious sign-in, confirm now”. Scammers rush you so you don’t stop to think [1].
- A request for data or money. Your password, a code from a text message, card details, a “fee” or “fine” to pay [1, 2].
- A spoofed address or link. The sender or site looks real but differs by one letter or domain: amazan.com instead of amazon.com [1]. Sometimes a letter is swapped for a lookalike from another alphabet, such as a Cyrillic “а” in place of a Latin “a”. Such a link is impossible to tell apart by eye.
- Shortened links. They hide where the link really goes [1].
- Unexpected attachments and invoices. A bill for something you never bought, an archive or document you are told to open right away [2].
- An offer that is too good. A prize, a refund, a free coupon [2].
How to check a suspicious email and its links
- Look at the full sender address, not just the name. Anyone can put any name there.
- Hover over a link without clicking. The real address appears at the bottom of the window. On a phone, press and hold the link.
- Don’t trust a logo or design. They are easy to copy.
- Check another way. Open the site yourself, from a bookmark or the app, or call a number from the official website. Don’t use contact details from the email itself [2].
- For advanced users: the headers. The Authentication-Results line shows whether the message passed SPF, DKIM and DMARC checks [3, 4]. If the checks failed and the message claims to be from a well-known company, that is a very bad sign. If they passed, that is not a guarantee: a scammer may have sent it from their own real domain.
What to do with a phishing email
- Don’t reply, and don’t click links or attachments, including an “unsubscribe” link [1].
- Mark the message as phishing or spam in your email [1, 5] and delete it [1].
- If it impersonates your bank or a service you use, tell them through their official website or app.
If you already clicked
- You entered a password. Change it right away and turn on a second factor. If you used the same password anywhere else, change it there too. More in How to protect your email from hacking.
- You entered card details. Call your bank using the number on your card or its official website.
- You opened an attachment. Update your system and security software, and scan your device [2].
- You entered nothing and only opened the page. Close it. That is usually enough, though updating your browser does no harm.
Sources
- CISA: Recognize and Report Phishing. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
- FTC: How to Recognize and Avoid Phishing Scams. https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
- RFC 8601: Message Header Field for Indicating Message Authentication Status. IETF, May 2019. https://www.rfc-editor.org/rfc/rfc8601
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC). IETF, May 2026. https://www.rfc-editor.org/rfc/rfc9989
- NCSC (UK): Phishing scams: how to spot and report them. https://www.ncsc.gov.uk/guidance/suspicious-email-actions