How to Spot Phishing Emails Before You Click Anything
Almost everyone has received a message that looked slightly off: a bank notice from a bank you do not use, a parcel update for something you never ordered. Learning to spot phishing emails is less about technical skill and more about slowing down for a few seconds. Attackers rely on speed and nerves, so the best defence is a short routine you apply every time.
Why phishing still works
Phishing is simply an attempt to trick you into handing over something valuable: a password, a card number, or access to your device. The message might arrive by email, text, a chat app or even a phone call. It works because it borrows trust. The sender pretends to be a company, a colleague or a government office you would normally respond to without thinking.
Modern fakes are often well written and use real logos. That means grammar mistakes are no longer a reliable clue. Instead, look at behaviour: what is the message asking you to do, and how hard is it pushing?
Check the sender, not just the name
The display name on an email is easy to fake. Anyone can call themselves Customer Support. Tap or hover over the name to reveal the real address behind it. Watch for these patterns:
- A domain that is nearly right but not quite, such as an extra letter or a hyphen added to a familiar brand name.
- A free personal mailbox being used by someone who claims to represent a large organisation.
- A reply-to address that differs from the sender address.
- A message that greets you with a vague phrase such as Dear customer when the company normally uses your name.
None of these alone proves a message is fake, but two or three together should make you stop.
Treat urgency as a warning sign
Real organisations do sometimes send time-sensitive notices, but scammers turn the pressure up on purpose. Phrases like your account will be closed today, confirm within one hour, or unusual activity detected are designed to make you act before you think. If a message tries to frighten or excite you, that emotion is the signal to pause.
Equally, be careful with offers that seem too generous: unexpected refunds, prizes, or job offers that arrive with no application. Curiosity and greed are as useful to a scammer as fear.
Inspect links without clicking them
On a computer, hovering the mouse over a link shows its real destination at the bottom of the window. On a phone, a long press usually displays a preview. Compare the address with what the text claims. If the button says it leads to your bank but the address is a string of unrelated words, do not proceed.
A safer habit is to ignore the link entirely. Open your browser, type the website address yourself or use a bookmark, and sign in there. If there is a genuine problem with your account, it will be visible once you are logged in.
Be wary of shortened links and QR codes
Shortened links hide their destination, and QR codes hide it completely. If you receive either one unexpectedly, especially in a message that asks for personal details, treat it with the same suspicion as any other unknown link.
Handle attachments carefully
Unexpected attachments are one of the oldest tricks. Invoices, delivery notes and scanned documents are common disguises. Documents that ask you to enable macros or editing before you can see the content deserve particular caution. If a colleague or supplier sends a file you were not expecting, confirm through a different channel, such as a phone call to a number you already have.
A quick routine to spot phishing emails
When something feels wrong, work through these steps in order:
- Stop and do not click, reply or download anything.
- Check the full sender address and read the message again slowly.
- Ask yourself whether you were expecting this message or have any relationship with the sender.
- Contact the organisation using details you find independently, not the ones in the message.
- Report the message using your email app’s phishing option, then delete it.
This routine takes less than a minute and removes nearly all of the risk.
What to do if you already clicked
Do not panic; many clicks lead nowhere harmful. The key is what happened next. If you only opened a page and typed nothing, close it and run a security scan on your device to be safe. If you entered a password, change it immediately on the real website, and change it anywhere else you used the same one. Turn on two-step sign-in for important accounts, since it often stops a stolen password from being enough.
If you shared card or banking details, contact your bank promptly through its official number so it can block or monitor the account. If you opened an attachment and your device behaves strangely, disconnect from the internet and seek help from a trusted technician or your workplace IT team.
Build habits that protect you long term
Use a password manager so that you never type a password into an unfamiliar page; it will not offer to fill in a login on a fake site. Keep your operating system and browser updated, because updates close holes that malicious pages try to use. Talk with family members, especially those less familiar with technology, about the same checks. A shared habit of saying let me look at that before you click is worth more than any software.
Frequently asked questions
Can I get infected just by opening a phishing email?
It is uncommon with up-to-date software. Most harm comes from clicking links, opening attachments or entering details. Still, it is wise to delete suspicious messages without interacting with them.
Are text messages and chat messages also phishing?
Yes. The same trick appears in texts, messaging apps and social media direct messages. The same checks apply: be cautious of urgency, unknown senders and unexpected links.
Should I reply to tell the sender to stop?
No. A reply confirms that your address is active and may lead to more attempts. Report the message and delete it instead.
