Phishing Emails and Their Warning Signs

What phishing is

Phishing is an attempt to trick you into handing over something valuable: a password, a payment, a one-time code, personal details or access to your device. The message is designed to look like it comes from someone you would trust, such as a bank, a delivery service, an employer, an online store or a colleague.

Email is the best-known channel, but the same techniques appear in text messages, social media messages, and phone calls. The clues below apply to all of them.

Common warning signs

No single sign proves a message is fake, and well-made phishing may show none. Treat these as reasons to slow down.

Urgency or threats. “Your account will be closed in 24 hours” or “Immediate action required” is meant to stop you from thinking. Real organizations usually give reasonable notice and several ways to check.

A mismatch between the displayed link and the real one. On a computer, hovering over a link usually reveals the true destination. On a phone, pressing and holding may show it. If the address differs from what the text claims, or contains unusual spellings or extra words, be suspicious.

An odd sender address. The display name can say anything. Look at the actual email address, and note small tricks such as swapped letters or a familiar name placed in front of an unrelated domain.

Generic greetings. “Dear customer” from a company that normally uses your name can be a clue, although some phishing messages use your real name because it was obtained elsewhere.

Unexpected attachments. Invoices, shipping documents or “scanned” files you did not expect can carry malicious software. Do not open them if you cannot confirm the sender.

Requests for sensitive information. Genuine organizations rarely ask you to send a password or a full card number by email, or to read out a one-time code.

Offers that are too good. Refunds, prizes or gifts you did not anticipate are common bait.

Writing that feels off. Awkward phrasing, spelling errors or unusual formatting are traditional clues. Be aware that tools can now produce polished text, so clean writing is not reassuring on its own.

Unusual requests from familiar people. A message from a manager asking you to buy gift cards, or from a friend asking for money urgently, may come from a compromised or imitated account.

Targeted messages

Some phishing is aimed at specific people using details found online, such as your employer, job title or recent activity. These are harder to spot. Sharing less personal data publicly gives such messages less to work with, and a habit of verifying unusual requests, particularly those involving money or access, protects you even when the message looks perfect.

Safe ways to verify a message

The key idea is to check through a route that the message did not supply.

1. Do not use the links, buttons or phone numbers in the message. Instead, open the organization’s website by typing the address yourself, or use its official app, then look for the same notice in your account.
2. Contact the sender separately. If a colleague or friend seems to be asking for something unusual, call or message them using details you already have.
3. Ask your workplace. Many employers have an IT or security contact, and forwarding a suspicious message to them is usually welcome.
4. Check the sender address and link carefully. Compare them with those from messages you know are genuine.
5. Wait. Real problems rarely vanish within an hour of you pausing.
6. Search for the wording. Others often report widespread campaigns, though a lack of reports does not prove a message is safe.

Reducing the damage if one slips through

• Keep a strong, unique password on each account, so one stolen password does not unlock everything.
• Turn on two-factor authentication. It can stop a stolen password from being enough, although some sophisticated schemes try to capture codes as well.
• Keep your devices and browsers up to date.
• Be careful with attachments, and consider keeping file backups in case malicious software damages your files.
• Use your email service’s spam filtering, which catches many suspicious messages. Senders worry about email deliverability for the same reason, and filters sometimes get it wrong in both directions, so they are no substitute for care.

If you clicked or replied

Do not panic. Many people do this, and quick action helps.

• If you entered a password, change it immediately on the real site, and change it anywhere else you used it.
• If you opened an attachment or installed something, disconnect from the network if you can, run a scan with security software you trust, and seek help from your IT contact or a qualified technician.
• If you shared card or bank details, contact the provider promptly.
• Report the message to your email service, workplace or the organization being imitated, then delete it.
• Watch your accounts for unfamiliar activity over the following weeks.

The same tactics appear in many other online scams, whatever channel they arrive through. If an account has actually been taken over, change its password from a trusted device and check its recovery options as soon as you can.