How to Spot a Phishing Email: 12 Red Flags

A phishing email is a message that pretends to come from someone you trust so that you click a link, open a file, hand over a password or send money. You can spot most of them by checking who really sent the message, where its links actually point, and whether it is pushing you to act quickly on something you did not expect.

Phishing borrows trust: a bank's logo, a colleague's name, a parcel company's tone. The habits below take seconds and work in any mail app.

The 12 red flags of a phishing email

1. The display name and the address do not match. "PayPal Support" can be attached to any address. Tap or hover over the name to reveal the full address. A brand writing from a free webmail account or an unrelated domain is a strong warning sign.
2. A lookalike or disguised domain. Attackers register domains that differ by one character (rnicrosoft.com with "r n" instead of "m"), add words (paypal-secure-login.com) or use the real name as a subdomain (paypal.com.account-check.net, which belongs to account-check.net). Internationalised domain names allow letters from other alphabets that look identical to Latin ones, such as a Cyrillic "а" in place of "a". Their underlying form starts with xn-- (punycode); if you see that prefix in a link or address you did not expect, treat it as suspicious.
3. Urgency, fear or pressure. "Your account will be closed in 24 hours", "unpaid invoice", "legal action". Artificial deadlines exist to stop you checking.
4. Links whose text and destination differ. The visible text of a link can say anything. The real target appears when you hover with a mouse, in the status bar or a tooltip. If the text says one site and the target is another, do not click.
5. Unexpected attachments. Be wary of any file you were not expecting, and especially of HTML files (they can open a convincing fake login page stored on your own computer), ZIP or other archives, ISO and IMG disk images, password-protected archives with the password in the email body, and Office documents that ask you to "enable content" or macros. Archives and disk images are popular because they can hide the real file type from mail filters.
6. A request for credentials or personal data. Legitimate companies do not ask you to confirm your password, PIN, full card number or one-time code by email or through a link in an email.
7. A QR code you are asked to scan. QR phishing ("quishing") puts the link inside an image so filters cannot read it and you open it on your phone, which is often less protected than a work computer. Be suspicious of QR codes in emails about MFA setup, document signing or account problems.
8. A different Reply-To address. The From line may look right while replies go elsewhere. When you press reply, check the address that appears in the To field. A mismatch is common in invoice fraud.
9. A generic greeting or wrong details. "Dear customer", "Dear user" or your email address used as your name suggests a mass campaign. A correct name proves nothing, though.
10. An offer that is too good to be true. Unexpected refunds, prizes, inheritance, crypto returns or a job you never applied for are bait. So is a small fee required to release a large payment.
11. A change of payment or bank details. In business email compromise, a supplier, colleague or executive "updates" their bank account or asks for an urgent transfer or gift cards. The email may come from a genuinely compromised account, so it can pass every technical check.
12. MFA prompts or codes you did not request. A burst of approval requests on your phone, or an email asking you to read back a code, means someone may already have your password and is trying to get past the second factor. Deny the request and change your password.

Quick reference: where to look

How to check a link without opening it

1. On a computer, hover over the link and wait for the real address to appear at the bottom of the window or in a tooltip.
2. On a phone, press and hold the link to see the address. Some phones show a live preview of the page, so copying the link and pasting it into a notes app is safer.
3. Find the registered domain: read the host name from the right, up to the first single slash. In https://login.example.com.secure-verify.io/account the domain is secure-verify.io, not example.com.
4. If you need to visit the service, type its address yourself or use a bookmark or the official app instead of the link.

Our phishing email analyzer checks pasted text or headers for deceptive links, spoofed senders and other warning signs without you having to open anything.

How to read email headers safely

Every email carries hidden headers that record which servers handled it and whether it passed authentication. Viewing them is safe because you are only reading text. Where to find them:

• Gmail: open the message, choose the three-dot menu, then Show original.
• Outlook on the web and new Outlook: open the message, choose the three-dot menu, then View and View message details.
• Classic Outlook for Windows: open the message, then File, Properties, and look in Internet headers.
• Apple Mail: View, Message, All Headers or Raw Source.

The most useful line is usually Authentication-Results, added by your own mail provider:

Authentication-Results: mx.example.net;
  spf=pass smtp.mailfrom=bounce.example-shop.com;
  dkim=pass header.d=example-shop.com;
  dmarc=pass header.from=example-shop.com

Check that the domains here match the brand you expect. Also compare the From, Reply-To and Return-Path addresses, and read the Received lines from the bottom up to see where the message started. Pasting the headers into our email header analyzer lays out every hop and authentication result in a readable form.

What SPF, DKIM and DMARC can and cannot tell you

These three standards let a receiving server check whether a message really came from the domain it claims:

• SPF lists the servers allowed to send mail for a domain, checked against the envelope sender (the Return-Path).
• DKIM adds a cryptographic signature that proves a domain took responsibility for the message and that signed parts were not altered.
• DMARC requires SPF or DKIM to pass for a domain that aligns with the visible From address, and tells receivers what to do when it does not: nothing, quarantine or reject.

When a brand publishes a strict DMARC policy, criminals cannot easily put that exact domain in the From line. That is why phishing so often uses lookalike domains, display-name tricks or compromised accounts instead. A message from paypa1-billing.com can pass SPF, DKIM and DMARC perfectly for its own domain. A pass proves who sent the email, not that the sender is honest. A fail on a message claiming to be from a large brand, on the other hand, is a strong reason for suspicion.

If you run a domain, check that your own records are in place with our SPF and DMARC checker, and read SPF, DKIM and DMARC explained for setup details.

What to do with a suspicious email

1. Do not click links, open attachments, scan QR codes or reply.
2. Verify through a separate channel: call the person on a number you already have, or sign in to the service by typing its address.
3. Report it. At work, use the "Report phishing" button or forward it as your IT team asks. In Gmail and Outlook, use the built-in Report phishing option. In the UK you can forward suspicious emails to the NCSC at report@phishing.gov.uk; in the US you can report fraud to the FTC at reportfraud.ftc.gov.

What to do if you already clicked

What matters is what happened after the click. Act quickly:

1. If you entered a password, change it right away on the real site, typed by hand, and on any other account that uses the same password. Then sign out of all other sessions, which most large services offer in their security settings.
2. Turn on or review MFA. Remove any devices, app passwords or authenticator registrations you do not recognise. Passkeys and hardware security keys resist phishing because they only work on the genuine website.
3. Check your mailbox settings. Attackers who get into an email account often add forwarding rules or filters that hide replies. Look for rules you did not create.
4. If you opened an attachment or ran a file, disconnect the device from the network and contact your IT team, or run a full scan with up-to-date security software if it is a personal device.
5. If you sent money or card details, call your bank or card provider immediately using the number on your card or its official website. Speed improves the chance of stopping a payment.
6. Tell people who may be targeted next, such as colleagues or contacts, if your account was used to send messages.

Frequently asked questions

Can you get hacked just by opening a phishing email?

For ordinary users on up-to-date mail apps, simply opening an email is rarely enough. The danger comes from clicking links, opening attachments, entering details or replying. Loading remote images may confirm to the sender that your address is active.

What is the difference between phishing and spear phishing?

Phishing is sent to large numbers of people with a generic lure. Spear phishing targets a specific person or organisation and uses real names, roles, projects or suppliers to seem credible, which makes it harder to spot.

If an email passes SPF, DKIM and DMARC, is it safe?

No. A pass only shows that the domain in the From address authorised the message. Criminals can register their own lookalike domains with valid records, and compromised real accounts pass too. Always judge the domain itself and what the message asks you to do.

How do I check if a link in an email is safe?

Hover over it or copy it without opening, identify the registered domain by reading from the right, and compare it with the organisation's real domain. If in doubt, go to the site directly instead of using the link.

Why do phishing emails use QR codes?

A QR code hides the link inside an image that many filters do not decode, and it moves you to your phone, which may lack the protections of a managed work computer and makes the full address harder to inspect.