How to Spot a Phishing Email: 7 Red Flags to Check

The advice everyone remembers is to look for bad spelling, and that advice retired years ago. Modern lures are clean, correctly branded, addressed to you by name and often sitting inside a thread you recognize. What still gives them away is not how the message reads but what it wants and where it points, and both can be checked in under a minute. If you want the mechanism behind the attack, how a phishing attack works covers it. This page is the check itself.

How to Spot a Phishing Email

Run these in order. Most messages fail at the second or third item, and you never have to reach the rest.

What Are the 7 Red Flags of Phishing?

If you want the list rather than the procedure, these are the seven, drawn from what CISA and the FTC both flag.

1. Urgent or emotionally loaded language. CISA's wording is messages claiming dire consequences for not responding immediately. Suspension, closure, legal action, a refund about to expire.
2. A request for personal or financial information. The FTC's list covers most lures: they noticed suspicious activity, there is a problem with your account or payment, confirm your information, here is an invoice you do not recognize, click to make a payment, register for a refund, take a free coupon.
3. A sender address that does not match the brand. Microsoft's guidance calls out mismatched domains and near-misses such as micros0ft.com, where a zero replaces the letter.
4. A link that does not go where the text says. Look-alike domains, and shortened URLs that hide the destination completely.
5. An attachment you did not ask for. Especially an invoice, a receipt, a resume or a shared document from someone you do not normally exchange files with.
6. A generic greeting, or a request that skips the normal process. "Dear customer" is the old version. The modern version is a real name attached to a request that would normally go through a system, a portal or a ticket.
7. Anything that moves money. A new bank account on a familiar invoice, a wire that must go today, a gift card purchase. This one is worth its own rule because it is where the losses are.

Grammar and spelling used to sit near the top of this list and no longer belong on it. CISA now says outright that in the era of artificial intelligence some emails will have perfect grammar and spelling, and tells readers to look for the other signs instead. The same is true of logos, formatting and signature blocks, all of which are copied in seconds. Anything that is easy for the attacker to fix is a weak tell. What they cannot fix is the address they send from, the domain they send you to, and the fact that they need you to act now.

Phishing is social engineering delivered by message, so the same tells apply to a text, a phone call or a chat message. The checks below are written for email because that is where most people meet it.

How to Check the Sender Address and the Link

These are the two checks that survive a well-made lure, and both take about five seconds once you know where to look.

The sender. The display name is free text chosen by whoever sent the message. The address is not. On a computer, click the sender name to expand it; on a phone, tap the name or the "from" line. What you are looking for is the domain after the at sign: the organization's real domain, not a look-alike, not a public mailbox provider, not a long string ending somewhere unfamiliar. In Outlook, a banner saying the sender could not be verified is a real signal.

The link. This is where most people go wrong, because a web address is read right to left, not left to right. Find the first single slash after https://. The two labels immediately before it are the actual site. Everything to the left of those is a subdomain the attacker chose freely and can set to anything.

On a computer, hover over the link and read the address in the status bar. On a phone, press and hold the link until a preview appears, then read it and cancel. Doing this on a phone matters more than it used to: the 2026 Verizon Data Breach Investigations Report found mobile social engineering success up 40 percent, and the reason is structural rather than psychological. A small screen truncates the sender address and hides the link destination, so the two checks that work are the two checks a phone makes hardest.

Phishing Email Examples and What Gives Them Away

Three lures you will actually receive, with the line that decides each one.

The billing hold. A streaming service writes that your account is on hold because of a payment problem, with a button to update your card. Everything is branded correctly and the greeting says "Dear customer". What gives it away is not the design; it is that a real billing problem is visible when you open the app yourself, and this message needs you to fix it here, now, through its button. The FTC uses this exact pattern as its worked example.

The password expiry. A message that appears to come from your IT department says your password expires today and links to a sign-in page that looks like your company's. It uses your real name and the right logo. What gives it away is the address it came from, which is external, and the destination domain, which is a look-alike. A genuine password policy runs through a system you already sign in to.

The delivery fee. A text says a package could not be delivered and a small fee is due, with a shortened link. The tell is that a shortener hides the destination, the fee is trivial enough to seem worth paying, and no carrier collects money by text. The amount is deliberately below the level at which people check.

What Happens If You Open a Phishing Email?

Almost nothing, on any modern mail client. Opening a message does not run code, and the fear that it might is the most common misconception about phishing. The risk is entirely in what you do next.

Replying is worth one line of its own: it confirms a live human reads that address, which raises the price of your address on the lists these campaigns are run from. So does clicking unsubscribe in a message you already suspect. CISA's advice is the simplest version: recognize, resist, delete. Report it, then delete it without replying.

How Can I Tell If an Email Is Real?

The harder half of this skill is clearing the genuine message, and no list of warning signs helps with that. Start by discounting the things that are not evidence of anything:

• A link in an email. Real organizations send links constantly. A link is not a red flag; an unexpected link to a login page is.
• An attachment from a colleague. Normal, unless you were not expecting it or the file type is odd.
• An external sender tag. It means the message came from outside your organization, which describes every customer, vendor and newsletter you deal with.
• A padlock or an https address. Certificates are free and attackers use them. The padlock says the connection is encrypted, not that the site is honest.
• Correct logos, formatting and grammar. All copied, all cheap, and cheaper still with generative tools.
• A message that appears inside an existing thread. Attackers reply into real threads, sometimes from a genuinely compromised account.

Once those are set aside, there is one move that resolves anything left. Go to the organization through a route you chose: type the address yourself, open the app, or call the number on your card or your last statement. Ask whether the message is theirs. It takes a minute and it is the only check that cannot be defeated by a better-made fake, which is why it is also the answer for every other attack in the wider catalog of cyber security threats.

How to Report a Phishing Email

Reporting is the part everyone skips, and it is what gets the fake site taken down before it reaches the next person.

The reason to bother is visible in the FBI's 2025 IC3 Annual Report. Phishing and spoofing was the most reported crime type of the year at 191,561 complaints, slightly down from 193,407 the year before. Reported losses went the other way, from $70,013,036 to $215,843,126. Fewer messages, better ones.

What to Do If You Fell for a Phishing Email

Speed matters more than anything else, because the attacker window is usually minutes rather than days.

If the account that was phished holds personal data, or if the message came out of a leak of your details, what to do after a data breach has the fuller response by data type. Turning on multi-factor authentication is the one change that makes the next one survivable: CISA's position is that any second factor beats none, and that phishing-resistant forms such as passkeys and security keys are the standard to aim for, because they cannot be typed into a copied page.