How to Spot a Phishing Email Before You Click

The short answer: to spot a phishing email, check the real sender address rather than the display name, hover over or long-press any link to see where it actually goes, and treat urgency as a warning sign on its own. If an email wants you to act fast, click a link or open an attachment you weren't expecting, go to the company's website or app directly instead. You can forward anything suspicious to [email protected].

I get sent screenshots of dodgy emails more than almost anything else I deal with. Someone's not sure if it's real, something about it feels off, and they just want a second opinion before they delete it or click something they shouldn't. Over the years I've turned that instinct into an actual routine, the same handful of checks in the same order, every single time. Here's exactly what I look at.

None of this takes more than about thirty seconds once it's a habit. The point isn't to become paranoid about every email, it's to have a routine you can run through automatically so the decision isn't a guess.

The First Thing I Check: The Sender Address

Before I read a single word of the message, I look at who it's actually from, not the display name, the address underneath it. A message claiming to be from your bank should come from your bank's actual domain, not something like a random free email address or a string of nonsense letters. Most email apps let you tap or hover on the sender name to reveal the real address behind it. It takes two seconds and catches more fakes than anything else on this list, because the display name is the one thing that's trivial for a scammer to fake convincingly. Watch for lookalike domains too, where a scammer swaps a letter or adds a word so the address looks close enough at a glance.

What I Do Before Clicking Any Link

I never click a link straight from an email if I can help it. On a computer, hovering over the link shows the actual destination in the corner of the screen, and it's astonishing how often that destination has nothing to do with the company the email claims to be from. On a phone, a long press does something similar. If a link looks even slightly off, a misspelled domain, an unfamiliar country code, a string of random characters, I go to the actual company's website directly by typing the address myself rather than trusting the link at all. That single habit has saved me more than once, and I've written more on the specific red flags I always check first if you want the fuller list.

The Urgency Is the Tell, Not the Content

Every convincing phishing email I've ever seen has one thing in common: it wants you to act before you think. A locked account, a missed delivery, a payment that needs confirming within the hour. Genuine organisations very rarely operate that way, and the ones that do usually give you a proper amount of time and a way to verify through a channel you already trust, not just the link in the message itself. Whenever I feel that little jolt of urgency reading an email, that's my actual signal to slow down, not speed up. It's the single most reliable check I have, more reliable than spelling or logos, because the emotional pressure is the one thing scammers can't fake away.

Attachments Get the Same Suspicion as Links

An unexpected attachment, especially one you weren't told to expect, gets treated exactly like a suspicious link in my routine. Invoices I didn't order, delivery notices for parcels I'm not expecting, documents that need me to "enable content" to view them properly, all of these are extremely common ways malware actually gets onto a device. If I'm not expecting the attachment, I contact the supposed sender through a separate channel to check it's genuinely from them before I open anything, even if the email itself looks polished and professional.

The Logo and Formatting Trick People Into False Confidence

I still hear from people who assume a professional-looking email with the right logo and colours must be genuine. It's one of the most out of date pieces of advice still floating around. Copying a company's branding pixel for pixel takes minutes with tools freely available online, and I've seen fake bank and delivery emails that were indistinguishable from the real thing at a glance, footer and all. Polish tells you nothing about authenticity anymore. What actually matters is the sender address, the link destination, and whether the message is trying to rush you, exactly the checks above, not how nice it looks.

The Same Checks Apply to Texts and App Notifications

Phishing doesn't stay in your inbox anymore, and I run through more or less the same routine for texts and app notifications too. A text claiming to be from a delivery courier with a link to "reschedule" your parcel gets the same treatment as a suspicious email: I don't tap the link, I go to the courier's actual app or website directly. Scam texts are often even harder to check the sender address on than email, since a phone just shows a name or short number, so the urgency test becomes even more important on mobile than it is on a laptop. If a text is trying to rush you into tapping something right now, that's the same signal, regardless of which app it arrived through.

The Newer Tricks: QR Codes and Fake Login Pages

Two things have changed how I check emails over the last couple of years. The first is QR codes. Some phishing emails now put the link inside a QR code instead of a normal link, partly because email filters struggle to read them, and partly because scanning one moves you onto your phone where it's harder to check the address. If an email asks you to scan a code to "re-verify" an account or sign a document, I treat it exactly like a suspicious link. The second is fake login pages. A lot of phishing no longer tries to install anything at all. It just sends you to a perfect copy of a Microsoft, Google or bank login page and waits for you to type your password in. That's why I never log in through a link in an email, and why two-factor authentication matters so much, because it means a stolen password on its own isn't enough.

What I Actually Do Once I've Decided It's Fake

I don't click unsubscribe, and I don't reply asking what it wants, both just confirm to whoever sent it that your address is active and being read. I delete it, or mark it as phishing if my email provider offers that option, since that helps train their filters for the next person too. If you ever do click something you shouldn't have, report it through Report Fraud so it's on record, and change your passwords straight away, starting with whichever account the email was impersonating. A password manager like NordPass also helps here in a quieter way, since it won't autofill your login details on a lookalike site even when the email itself looks completely convincing, which is often the first real sign something's wrong. My Safety Toolkit has the tools I use myself to keep my own inbox clean, and if you want a second pair of eyes on a suspicious email, feel free to get in touch.

What to Do If You've Already Clicked

Don't panic, and don't beat yourself up about it, it happens to careful people and it doesn't make you careless. Change the password for that account straight away, and for any other account using the same password, which is exactly why a password manager like NordPass earns its keep, since it makes giving every account its own password painless rather than a chore. Turn on two factor authentication if you haven't already. If you entered card details, ring your bank immediately using the number on your card. And if it's a work account, tell your IT contact even if it feels embarrassing, they would genuinely rather know now than find out later.

Reporting It Helps Everyone, Not Just You

Reporting a phishing email doesn't undo anything that's already happened, but it does help going forward, both for you and for whoever else was targeted in the same wave. If you want to report a phishing email you've received in the UK, Report Fraud is the place to do it, and most email providers also have a dedicated report button that feeds the same intelligence back into their filters. I report every one I get, even the obvious ones, because that reporting data is part of what makes spam filters better at catching the next wave before it lands in someone else's inbox.

The Body Copy Follows a Formula

The message body had three parts, and I see this same shape constantly. First, a brief statement of the problem, kept vague on purpose so it could apply to almost anyone. Second, a consequence if you do not act, in this case the parcel being returned to sender. Third, a single button to fix it.

Notice what is missing. No parcel number that matches anything I could check independently. No specific date. No named person. Genuine companies tend to over include this kind of detail because it reduces their own support queries. Scam emails tend to under include it because specific, checkable detail is exactly what would let you catch them out.

The tone is also flatter than a real company's marketing usually is. Real courier emails often have a house style, a bit of personality, maybe an offer or a link to their app. This one read like it had been generated to be as universally applicable as possible, which is another way of saying it read like it had been generated for a mass send.

The Bank Phone Call That Catches the Most People Out

This one worries me more than any text message, because it doesn't rely on a dodgy-looking message, it relies on a confident voice on the other end of the phone. Someone calls claiming to be from your bank's fraud team, tells you there's suspicious activity on your account, and talks you through moving your money somewhere safe. Real banks will never ask you to transfer money to a new account to protect it, and they'll never ask for your full PIN or a one-time passcode over the phone. If you get one of these calls, hang up and ring your bank back on the number printed on your card, not a number the caller gives you. The Take Five to Stop Fraud campaign has some excellent guidance on exactly this kind of call, and it's worth five minutes of anyone's time. I've had clients who work in banking tell me they still hesitate for a second on these calls, and they know exactly what to listen for, so don't judge yourself for not spotting it instantly.

Phishing Email Questions I Get Asked

What is a phishing email?

It's an email pretending to be from someone you trust, like your bank, a delivery company or a well-known brand, designed to get you to click a link, open an attachment or hand over personal details. The aim is usually to steal a password or money.

What happens if I click a link in a phishing email?

Don't panic. Clicking alone doesn't usually do much damage. If you typed in a password, change it straight away and turn on two-factor authentication. If you entered card or bank details, ring your bank on the number on your card. If you downloaded something, run a full security scan.

Can you get hacked just by opening an email?

It's very rare these days on an up-to-date device. The real risk comes from clicking links, opening attachments or enabling content in a document, so keep your device updated and be careful with anything you weren't expecting.

How do I report a phishing email in the UK?

Forward it to [email protected], which is run by the National Cyber Security Centre. For scam texts, forward the message to 7726. I've written up where to report a scam depending on what kind it is if you need the full list.

Why am I suddenly getting so many phishing emails?

Usually because your email address has turned up in a data breach or a marketing list somewhere. I've explained why you might be getting more scams than you used to in a separate post.

I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.

Keep reading

This guide is part of Kells Security Solutions, where I explain online safety in plain English. Next, have a look at the difference between phishing and other scams or how to build a password worth trusting. If something has already gone wrong, here is where to report a scam in the UK.