How to Spot a Phishing Email in 30 Seconds
Phishing emails are written to make you act before you think. The good news is that the same few tricks appear again and again, and a short routine catches most of them. Here are seven checks that take about thirty seconds, followed by what to do if a message fails them.
Check 1: the real sender address
Mail apps show a display name such as "Account Security" or the name of your bank. That name is free text that anyone can write. Tap or hover over it to see the actual address behind it.
- Look at the domain, the part after the
@. A bank does not write from a free webmail account or from a domain with random words added. - Watch for look-alikes: a digit instead of a letter, an extra letter, a hyphen, or a different ending such as
.coinstead of.com. - Read the domain from right to left. In
secure.yourbank.com.account-check.netthe real domain isaccount-check.net; everything before it is decoration.
Check 2: where the links really go
Never judge a link by its text. Before clicking, hover the mouse over it (on a phone, press and hold) and read the address that appears. The same right-to-left rule applies. If the domain does not belong to the company the email claims to be from, do not click. Our guide How to Check a Link Before You Click covers short links and redirects in more detail.
Check 3: urgency and threats
"Your account will be closed in 24 hours." "Unusual sign-in detected, confirm now." "Final notice." Pressure is the core technique of phishing because it stops you from taking the ten seconds these checks need. Real companies do send urgent messages, but they never require you to act through the email. You can always open the website or app yourself.
Check 4: what it asks for
Be suspicious of any email that asks you to:
- enter a password or a one-time code on a page you reached from the email;
- confirm card details, bank details or an identity document;
- pay an unexpected invoice, fee or "customs charge";
- install a program, browser extension or "security update";
- change payment details for a supplier or colleague.
That last one is a favourite in business email fraud: the message looks like it comes from a known supplier and asks you to pay to a new account. Always confirm such changes by phone using a number you already have.
Check 5: attachments you did not expect
Invoices, delivery notes, "scanned documents" and voicemail files are common bait. Be especially careful with archives (.zip, .rar), disk images, HTML files and office documents that ask you to "enable editing" or "enable content". If you were not expecting the file, ask the sender through another channel before opening it.
Check 6: does it know who you are?
A generic greeting ("Dear customer", "Hello user") from a service that knows your name is a warning sign. The reverse is not proof of safety: data from leaks lets scammers include your name, address or even an old password. Personal details make a message more convincing, not more legitimate.
Check 7: the authentication result
Most mail services check whether a message really came from the domain it claims, using SPF, DKIM and DMARC. Some show a warning banner or a "via" note when a check fails. If you want to see the details yourself, open the message headers and look for the Authentication-Results line; our guide How to Read Email Headers walks through it. A pass does not make a message safe (scammers can authenticate their own look-alike domains), but a failure on a message claiming to be from a big brand is a strong red flag.
The thirty-second routine
Sender domain → link destinations → pressure → what it asks for → attachments → greeting → authentication. If anything feels off, do not click. Go to the service directly.
Common phishing patterns right now
| Pattern | What it looks like | The giveaway |
|---|---|---|
| Delivery problem | "Your parcel is on hold, pay a small fee" | You did not order anything, or the courier never charges by email link |
| Account security alert | "New sign-in from another country, verify now" | The link leads to a domain that is not the service's own |
| Shared document | "A file has been shared with you, sign in to view" | The sign-in page asks for a password from a different service |
| Invoice or refund | "Your refund is ready" or "Overdue invoice attached" | Unexpected attachment or a request for card details |
| Boss or colleague | "Are you at your desk? I need a quick favour" | Sender address is a free webmail account, request involves gift cards or payments |
If you already clicked
- Do not enter anything else. Close the page.
- If you typed a password, change it immediately on the real website, and on any other site where you used the same password.
- If you typed card details, call your bank using the number on the back of the card.
- If you opened an attachment or installed something, disconnect from the network and run a full security scan; at work, call your IT team right away.
- Turn on two-factor authentication for the affected account if it was not already on.
- Report the message using your mail service's "report phishing" option. It helps protect other people.
A note on temporary inboxes
If you use a mail generator, apply exactly the same checks. Public inboxes receive plenty of phishing because they are easy to find, and a message in a temporary inbox is no more trustworthy than one in your personal mailbox. Never sign in to an important account from a link you found there.
Summary
Phishing depends on speed and surprise. Slow down for thirty seconds, check where the message is really from and where its links really go, and never act on a request for passwords, payments or software through the email itself. When in doubt, open the service yourself.