1. The Sender Address Doesn’t Match
This is the first thing to check, every time. Phishing emails impersonate banks, delivery companies, streaming services, and even your employer — but the actual sender address betrays them. Look at the full address, not just the display name. An email claiming to be from your bank that arrives from a lookalike domain instead of the official one is a fake. Hover over or tap the sender name in your email app to reveal the real address.
2. Urgency and Threats
“Your account will be suspended in 24 hours.” “Unauthorized login detected — verify now.” Phishing thrives on panic because panic short-circuits careful thinking. Legitimate companies rarely threaten immediate account closure by email, and they almost never demand instant action through an embedded link. If a message makes your heart race, slow down — that’s exactly the reaction the attacker wants.
3. Generic Greetings
“Dear customer,” “Dear user,” or simply “Hello” — phishing emails sent in bulk usually don’t know your name. Real companies you’re a customer of generally address you by name. This isn’t foolproof (data breaches do give attackers real names), but a generic greeting on a message claiming to be from your bank is a strong warning sign.
4. Links That Don’t Go Where They Claim
Hover your cursor over any link before clicking (on mobile, long-press to preview the URL). Phishing emails disguise malicious links behind trustworthy-looking text like “Log in to your account.” If the preview shows a strange domain, a URL shortener, or a long string of random characters, don’t click it. When in doubt, open your browser and navigate to the company’s site yourself instead of following the email’s link.
5. Unexpected Attachments
A package-tracking email with a ZIP file attached. An “invoice” you never ordered as a Word document. Attachments are a classic malware delivery method — the file can contain macros or exploits that infect your device the moment you open it. Never open an unexpected attachment, and be especially wary of archives, Office documents asking you to “enable content,” and executable files.
6. Requests for Personal Information
No legitimate bank, tech company, or government agency will email you asking for your password, full credit card number, or Social Security number. Ever. If an email asks you to “confirm” sensitive details by replying or filling in a form, it’s phishing. Real companies direct you to log in through their official website or app for anything sensitive.
7. Poor Grammar — But Don’t Rely on It Alone
Sloppy spelling and awkward phrasing used to be the easiest phishing tell. Attackers have improved dramatically, and AI-generated text has erased most of the old mistakes. Still, odd phrasing, inconsistent branding, or clumsy translations remain common in phishing — just treat them as one signal among many, not proof by themselves.
8. The “Too Good to Be True” Offer
You’ve won a prize you never entered. A refund is waiting for you. A celebrity is giving away gift cards. Lures based on greed and curiosity are phishing staples. Ask yourself: did I enter this contest? Do I have an order with this company? If the answer is no, the email is almost certainly a trap designed to harvest your details or install malware.
9. Mismatched Branding and Weird Formatting
Compare the email to genuine messages from the same company. Phishing emails often use slightly off logos, wrong fonts, broken layouts, or footers that don’t match the real thing. They may also come from a domain that looks right but has a subtle twist — a zero instead of an “o,” an extra hyphen, or a different top-level domain. These details are easy to miss on a phone screen, so take a second look.
What to Do When You Spot One
Don’t click anything, don’t reply, and don’t download attachments. Most email apps let you report a message as phishing — use that option, because it helps protect others. If the email pretends to be from a company you actually use, go to that company’s official site or app directly (not via the email) and check for alerts there. If you already clicked a link or entered credentials, change your password immediately and enable two-factor authentication.
How to Protect Yourself Going Forward
Turn on two-factor authentication everywhere it matters — email, banking, and social accounts. Keep your browser and operating system updated, since patches close the holes phishing malware exploits. Consider a password manager: besides generating strong passwords, it won’t autofill your credentials on a fake lookalike domain, which gives you a quiet extra layer of protection. Finally, slow down. The single best anti-phishing tool is a thirty-second pause before acting on any surprising email.
Conclusion
Phishing attacks succeed because they exploit trust and haste, not because the technology is unbeatable. Check the sender, distrust urgency, inspect links, and never hand over sensitive information through email. Make these nine checks a habit, and you’ll filter out the vast majority of phishing attempts before they can do any harm.