A phishing email is a message designed to trick you into revealing your password, payment details, or other sensitive information. It might pretend to be from your bank, your email provider, a delivery company, or even your boss. Phishing is one of the most common and dangerous online threats, because it targets the one part of any security system that is hardest to fix: human trust. The good news is that every phishing email leaves clues. Once you know what to look for, you can spot the fakes with confidence.
How Phishing Works
A phishing attack works by creating a sense of urgency or opportunity. The email will try to make you act quickly, before you have time to think. Common emotional triggers include fear ("your account will be closed"), curiosity ("you have a package waiting"), greed ("you have won a prize"), or authority ("the CEO needs you to do this now"). When you click the link in the email, you are taken to a fake website that looks like the real one. If you enter your password there, it goes straight to the attacker.
Seven Warning Signs of a Phishing Email
1. A Mismatched or Odd Sender Address
The display name might say "Your Bank" but the actual email address could be "security-alert@mail-server-1234.ru". Always check the full sender address, not just the name. On a computer, hover over the sender name to reveal the real address.
2. Urgent or Threatening Language
Phishing emails almost always create pressure. Phrases like "your account will be suspended in 24 hours" or "immediate action required" are designed to make you panic and click without thinking. Legitimate organisations rarely communicate this way.
3. Generic Greetings
A real email from your bank will usually address you by name. A phishing email often says "Dear Customer" or "Dear Account Holder" because the sender does not actually know who you are.
4. Suspicious Links
Before clicking any link, hover your mouse over it to see the real destination. A link that displays "www.yourbank.com" might actually point to "www.yourbank.security-update.tk". If the destination looks odd, do not click.
5. Spelling and Grammar Mistakes
Large organisations have editors who review their emails. Multiple spelling errors, awkward phrasing, or inconsistent formatting are strong signs of a phishing attempt.
6. Requests for Sensitive Information
No legitimate bank, email provider, or government agency will ever ask you to send your password, full card number, or PIN by email. Any email that does so is a phishing attempt, full stop.
7. Unexpected Attachments
An attachment you were not expecting — especially a .zip, .exe, or macro-enabled document — can install malware on your device. Do not open attachments from senders you do not know, and be cautious even with known senders if the message seems out of character.
A Real-World Example
Imagine you receive an email that looks like it is from your bank. It says: "We detected unusual activity on your account. To prevent suspension, please verify your identity within 24 hours." There is a button labelled "Verify Now." The email is addressed to "Dear Customer." The sender address is "noreply@bank-secure-verify.com" rather than your bank's real domain. This email has four red flags: urgency, a generic greeting, a suspicious sender address, and a request to click a link. It is almost certainly phishing.
What to Do When You Receive a Suspicious Email
- Stop and do not click any links or download any attachments.
- Check the sender's full email address and hover over any links to inspect them.
- If the message claims to be from a company you use, open a new browser tab and log in to that company's website directly — never through the email link.
- If you are still unsure, contact the organisation using a phone number or email from their official website, not the one in the email.
- Report the email as phishing using your email provider's report button, then delete it.
What to Do If You Already Clicked
If you clicked a link and entered your password, act immediately. Change that password on the real website, enable two-factor authentication if you have not already, and check whether the attacker has changed any account settings. If you entered payment details, contact your bank right away. If you downloaded an attachment, disconnect your device from the internet and run a full antivirus scan. Speed matters — the faster you act, the more you limit the damage.
Building a Habit of Caution
The best defence against phishing is a habit of healthy suspicion. Treat every unexpected email that asks you to click, log in, or share information as guilty until proven innocent. Pause, breathe, and verify through a channel you control. That five-second pause is the difference between safety and a compromised account.
Conclusion
Phishing emails rely on urgency and trust to bypass your better judgement. By learning the warning signs — mismatched senders, generic greetings, suspicious links, urgent language, and requests for sensitive data — you can spot the fakes before they cause harm. Make it a rule: never click a link in an unexpected email. Go to the website directly. Share this knowledge with your family and colleagues, because one informed person can protect an entire household or team from a costly attack.