Email CheckerCheck an email

FIG_100 · security guide · red flags

How to spot a phishing email

Phishing still starts the majority of breaches, and modern attempts are polished — no typos, real logos, correct branding. Here are the ten signals that actually hold up, what to do when you find one, and how to recover if you already clicked.

Written the way an analyst reads a suspicious message: sender first, links second, language third, attachments last. Every flag below includes what it looks like and why it works.

Read the red flags →Scan an email

FIG_101 · the checklist · 10 signals

10 red flags in a phishing email

How to use this list: no single flag proves phishing on its own. Read the sender address in full, then the links, then the request. Two or more flags in the same message means stop and verify out of band — a phone call to a number you already have, never one from the email.
  1. 01

    The sender domain is almost right

    Attackers register look-alike domains: paypa1-verify.com, micros0ft-support.net, or a real brand as a subdomain of their own domain (paypal.com.secure-login.ru). Read the address from right to left — the part just before the first single slash is the real domain.

  2. 02

    The display name doesn't match the address

    "Microsoft Account Team" sent from a random Gmail or free webmail address is a classic spoof. Mail clients hide the actual address by default, so expand the header before you trust it.

  3. 03

    Reply-To points somewhere else

    A legitimate From with a Reply-To on an unrelated domain means your reply — and anything you send in it — goes to the attacker.

  4. 04

    Manufactured urgency or threats

    "Your account will be closed in 24 hours", "final warning", "immediate action required". Urgency exists to stop you from checking. Real companies rarely destroy your account over an unanswered email.

  5. 05

    Link text doesn't match the link target

    HTML email lets any text hide any URL. Hover (desktop) or long-press (mobile) to preview the destination. A link that reads https://www.paypal.com but resolves to a raw IP or shortener is phishing.

  6. 06

    Shorteners, raw IPs, and odd file paths

    bit.ly links, http://192.168.x.x addresses, and long random paths in transactional email are strong signals. Legitimate senders link to their own documented domains.

  7. 07

    Unexpected attachments

    .html, .htm, .iso, .img, .zip with a script inside, or an Office file demanding you "enable content" — all common malware carriers. Invoices you never ordered are the most common lure.

  8. 08

    It asks for credentials, payment, or codes

    No bank, employer, or platform will ask you to confirm a password, full card number, or one-time code by email. A request for gift cards or a same-day wire transfer is fraud, full stop.

  9. 09

    Generic or slightly wrong greeting

    "Dear Customer" or "Dear user@example.com" from a service that knows your name is a bulk-phish tell. Note the inverse too: spear-phishing uses your real name and job title from LinkedIn.

  10. 10

    It doesn't fit the context

    A password reset you didn't request, a shipping notice for nothing you ordered, a CEO messaging you directly about a confidential purchase. Out-of-band verification — a phone call to a number you already have — resolves all of these in a minute.

How to check the email headers

The visible message is styled by the sender; the headers are not. In Gmail open the three-dot menu and choose Show original; in Outlook use File → Properties → Internet headers; in Apple Mail use View → Message → All Headers. Then look for:

  • Return-Path / Reply-To — should match the visible From domain.
  • SPF, DKIM, DMARC — anything other than pass on a supposedly big-brand email is a serious warning.
  • Received chain — read it bottom-up; the first hop reveals where the message really originated.

Types of phishing worth knowing

Spear phishing
Targeted at you personally using real details about your job and colleagues.
Business email compromise (BEC)
An executive or supplier "asks" for an urgent payment or changed bank details.
Clone phishing
A real email you received before, resent with the links or attachment swapped.
Smishing and vishing
The same playbook over SMS or a phone call, often as a follow-up to the email.

What to do if you already clicked

  1. Disconnect from the network if you downloaded or opened a file.
  2. Change the password for the affected account from a different, trusted device — and anywhere you reused it.
  3. Turn on two-factor authentication, preferably with an app or hardware key.
  4. Run a full malware scan and check for new mail forwarding rules or app grants.
  5. Report it to your IT/security team, the impersonated brand, and your national reporting body; then delete the message.

Frequently asked questions

Are phishing emails always full of typos?

No. AI-assisted campaigns are grammatically clean and copy brand templates precisely. Judge the sender domain, the links, and the request — not the writing.

Is opening a phishing email dangerous?

Simply reading it is usually safe in a modern mail client. The risk comes from clicking links, opening attachments, enabling content, or replying.

Can I trust an email because it has a padlock/HTTPS link?

No. HTTPS certificates are free and most phishing pages have one. It proves encryption, not honesty.

FIG_106 · try the scanner

Not sure about an email you received?

Paste it into the free Email Checker for an instant risk score and a breakdown of every red flag. Nothing leaves your browser.

Check an email now →