Phishing is the most common way that ordinary people get hacked. Not sophisticated malware, not Hollywood-style hacking — just a convincing email that tricks someone into handing over their password or clicking a malicious link. Billions of phishing emails are sent every year, and the attacks keep getting more polished: perfect logos, flawless grammar, and messages that look exactly like they came from your bank, your boss, or a delivery company.

The good news is that phishing emails almost always leave clues. Once you know what to look for, most of them become easy to spot. This guide walks through how phishing works, the red flags to check in any suspicious email, and what to do if you think you have been targeted.

What Phishing Actually Is

Phishing is a type of social engineering — an attack that targets people rather than computers. The attacker impersonates a trusted organization or person and creates a sense of urgency so you act before you think. The goal is usually one of three things:

1. Stealing login credentials — a fake login page that captures your username and password
2. Installing malware — an attachment or link that infects your device
3. Tricking you into a payment — a fake invoice or an urgent request to wire money

There are variations. Spear phishing targets a specific person with personalized details. Whaling goes after executives. Smishing uses text messages instead of email, and vishing uses phone calls. But email phishing remains the most common, and the detection skills transfer across all of them.

Red Flag #1: The Sender's Address

This is the single most reliable check. Display names lie; email addresses are harder to fake convincingly.

• An email claiming to be from your bank but sent from security-alerts@bnk-secure-verify.com is not from your bank.
• Watch for lookalike domains: micorsoft.com instead of microsoft.com, or paypa1.com instead of paypal.com.
• Be suspicious of free email providers for official business: a real company will not email you from a Gmail or Yahoo address about your account.
• On your phone, tap the sender name to reveal the actual address — mobile email apps often hide it by default.

Attackers can spoof the "From" name easily, so never trust the display name alone.

Red Flag #2: Urgency and Threats

Phishing emails almost always try to rush you. Common pressure tactics include:

• "Your account will be suspended in 24 hours"
• "Unusual activity detected — verify immediately"
• "You have an unpaid invoice — final notice"
• "Your package could not be delivered — click to reschedule"

Legitimate companies do send urgent messages sometimes, but phishers rely on panic to short-circuit your judgment. If an email makes your heart rate rise, that is exactly when you should slow down. A real bank will never close your account because you took ten minutes to verify a message through official channels.

Red Flag #3: Links That Don't Go Where They Claim

Hover over any link (or long-press on mobile) before clicking. The preview shows the real destination. Look for:

• Mismatched domains — the text says www.yourbank.com but the link points to yourbank.secure-login-verify.net
• URL shorteners hiding the destination in an unexpected context
• Subtle misspellings in the domain, or extra words tacked on (apple-support-center.com is not Apple)
• Links that use an IP address instead of a domain name

A genuinely useful habit: if an email asks you to log in, do not click the link at all. Open your browser and go to the site yourself by typing the address or using a bookmark. Then you know you are on the real site.

Red Flag #4: Attachments You Didn't Ask For

Unexpected attachments are a classic malware delivery method: fake invoices, "shipping labels," or documents that ask you to "enable macros" or "enable content." Real companies rarely send unsolicited attachments, and they never ask you to enable macros to view a document.

Be especially careful with files like .zip, .iso, .html, and Office documents from unknown senders. When in doubt, do not open it — contact the supposed sender through a known channel to confirm.

Red Flag #5: Generic Greetings and Odd Details

Mass phishing emails often start with "Dear Customer" or "Dear User" because the attacker does not know your name. (Spear phishing may use your real name, so this is a clue, not a guarantee.)

Other details that give attacks away:

• Grammar and tone that feel slightly off for the supposed sender — though AI has made this less reliable than it used to be
• Requests for sensitive information — legitimate companies will not ask for your password, full credit card number, or PIN by email
• Inconsistencies like the wrong logo, outdated branding, or a footer that does not match the company's real one
• "From" and "Reply-To" mismatch — the reply address goes somewhere different from the sender

The New Wave: AI-Powered Phishing

It is worth knowing that phishing is getting harder to spot. Attackers now use AI to write flawless, personalized messages in any language, clone voices for phone scams, and even generate fake login pages that are pixel-perfect copies of the real thing. The old advice of "look for bad spelling" is no longer enough.

What still works against sophisticated attacks:

• Verify through a separate channel. Got an urgent request from your "boss"? Message them on a different app or call a known number. Got a bank alert? Open the bank's app directly.
• Check the actual domain in links and sender addresses — AI can fake words, but it cannot fake owning yourbank.com.
• Use a password manager with autofill. As covered in our password manager guide, autofill will not fill your credentials on a lookalike domain. It is one of the most effective anti-phishing tools you have.
• Enable two-factor authentication everywhere. Even if an attacker steals your password, a second factor (especially an authenticator app or security key) usually stops them from getting in.

What To Do With a Suspected Phishing Email

1. Do not click links or open attachments. Do not reply, either — replying confirms your address is active.
2. Report it. Most email providers have a "Report phishing" option. Your company's IT team or email provider uses these reports to protect others.
3. Delete it after reporting.
4. If you already clicked or entered credentials: change the password immediately (from the real site, not via any email link), enable two-factor authentication, and check the account for unfamiliar activity. If it was banking or payment info, contact the provider directly.

Real-World Examples to Learn From

The delivery text. "Your package is held — pay a $2 redelivery fee here." Delivery companies do not operate this way. They do not text links demanding small fees.

The boss's urgent request. An email that looks like it is from your CEO asking you to buy gift cards or wire money immediately. Executives do not request this by email, and attackers count on junior staff being afraid to question it.

The account verification. "We noticed a login from a new device. Confirm it was you." The link leads to a perfect replica of the login page. The real move: open the service's app yourself and check for alerts there.

The invoice attachment. A "past due invoice" from a vendor you vaguely recognize, with a Word document attached. Opening it and enabling macros installs malware. When any invoice arrives unexpectedly, verify with the vendor through known contact details.

Frequently Asked Questions

Can phishing emails infect my computer just by opening them? Simply opening a plain-text email is very unlikely to infect a modern, updated device. The danger is in clicking links and opening attachments. That said, keep your email client and operating system updated, since vulnerabilities do occasionally get exploited.

What is the difference between phishing and spam? Spam is unsolicited bulk email, usually advertising. Phishing is fraud — it pretends to be someone you trust to steal credentials, money, or data. All phishing is malicious; most spam is just annoying.

I entered my password on a fake site. What now? Act fast: change the password on the real site immediately, and change it anywhere else you reused it. Turn on two-factor authentication. Check for unauthorized activity, and if financial details were involved, alert your bank. Consider it a lesson that argues strongly for a password manager and unique passwords.

Are text message phishing attacks (smishing) common? Yes, increasingly so. The same rules apply: do not click links in unexpected texts, verify through official apps or numbers, and remember that banks and delivery companies do not ask for sensitive info by text.

Key Takeaways

• Check the sender's real address, not just the display name
• Slow down when an email creates urgency — panic is the attacker's tool
• Hover over links and never log in through an email link; go to the site directly
• Treat unexpected attachments as guilty until proven innocent
• Verify through a separate channel whenever money or credentials are involved
• Use a password manager and two-factor authentication as your safety net

Phishing works because it exploits trust and urgency, not because the technology is unbeatable. A calm thirty-second check — sender address, link destination, a moment of skepticism about urgency — defeats the vast majority of attacks. Make those checks a habit, and you become a very difficult target.

Related Articles

Related Articles

• Two-Factor Authentication (2FA): The Complete Guide
• Password Managers: Why You Need One in 2026
• HTTP vs HTTPS: What's the Difference and Why It Matters
• Public and Private Keys Explained Simply
• Browser Cookies Explained: What They Do
• Social Engineering Attacks Explained With Examples

Try Our Free Tools

Try Our Free Tools

• URL Extractor

Email Extractor