Spotting Phishing Emails (and Why Spotting Isn't Enough)

Most phishing advice still focuses on bad spelling and weird formatting. That made sense once. Today a lot of phishing emails are clean, well written and use the real company's logo, because copying a legitimate email takes no effort and writing tools fix the grammar. So I'd rather teach the tells that still work, and then the habit that matters more than any of them.

The tells that still work

Urgency or fear. Your account will be closed. Your package is held. Unusual sign-in detected. Payment failed, update now. The whole point is to get you acting before you're thinking. Real companies do send urgent emails sometimes, but pressure should always make you slow down, not speed up.

The sender isn't who the name says. Email apps show a display name, and anyone can set a display name to "PayPal" or "IT Support." Tap or hover on it to see the actual address. A message from "Microsoft" sent from a random Gmail account or a domain like micr0soft-support.co is a giveaway.

Links that go somewhere else. On a computer, hover over a link without clicking and look at the actual destination, usually shown in the bottom corner of the window. On a phone, long-press it. Check the real domain, which is the part right before the first single slash. paypal.com.account-verify.net is a site at account-verify.net, not PayPal.

Lookalike domains. Swapped letters, extra words, different endings. rnicrosoft instead of microsoft (r and n together look like an m). yourbank-secure.com instead of yourbank.com. These are easy to miss when you're skimming on a small screen.

Unexpected attachments. Invoices you didn't expect, "voicemail" files, zipped documents, HTML files, or anything asking you to enable macros or editing to view it. An HTML attachment that opens a login page in your browser is a popular trick right now.

Requests that skip the normal process. Gift cards. A vendor asking to update their bank details for the next payment. Your boss emailing from a personal address asking for something "quickly and quietly." Those are business email compromise scams, and they often contain no links or attachments at all, so filters miss them.

Shared documents you weren't expecting. "Someone shared a file with you" that leads to a login page. Real file-sharing services send these too, which is exactly why it works.

QR codes in emails. A QR code asking you to "rescan to keep your account active" moves the link to your phone, where it's harder to inspect and your work security tools may not be watching.

The habit that beats all of this

Here's the thing. Even careful people miss a good one when they're tired, busy, or the timing happens to be perfect. If your defense depends on noticing every time, it'll eventually fail.

So don't use the email as the path. If a message says something's wrong with your account, close it, open the app or type the site's address yourself, and check there. If your bank really has a problem, it'll show up when you log in normally. If a coworker or vendor asks for money or bank changes, confirm by calling a number you already have, not one in the email.

Two tools also do a lot of quiet work for you:

A password manager only autofills on the real domain it saved the login for. If you click a link and your password manager doesn't offer to fill anything, treat that as an alarm bell. Don't copy and paste the password in manually to "make it work."

Passkeys and hardware security keys go further. They're bound to the real site and simply won't work on a fake one, so even a perfect copy of a login page gets nothing.

If you already clicked

Don't panic, and don't hide it. Clicking a link alone usually isn't a disaster. If you entered a password, change it right away on the real site (and anywhere else you reused it), and check that two-factor is on. Sign out of other sessions if the site lets you. If you entered a two-factor code too, assume the attacker may have gotten in and look at recent account activity. If it's a work account, tell your IT or security team immediately. The faster they know, the more they can contain, and nobody competent is going to blame you for reporting it.

If you typed in card details, call your card company using the number on the back of the card.

And then report the email using your mail app's "report phishing" option. It helps the filters catch the next one before it reaches someone else.