What Is Phishing and How Can You Spot a Fake Email?

Your inbox is supposed to be a safe place for bills, receipts, work updates, and messages from people you trust. Phishing turns that trust against you. A single convincing fake email can trick you into handing over a password, a bank login, or a one-time code in less than a minute.

The good news is that phishing emails almost always leave clues. Once you learn what those clues look like, you can spot most attacks before you click anything. This guide explains phishing in plain language and gives you a practical checklist you can use every day.

Quick Answer

Phishing is a scam where criminals send fake emails that look like they come from a trusted company to steal your passwords, money, or personal data.

Spot a fake email by checking the sender address carefully, looking for urgent threats, hovering over links before clicking, and watching for poor spelling or unexpected attachments.

If an email asks you to log in or pay urgently, do not use its link. Go directly to the official website or app instead.

What Is Phishing, Exactly?

Phishing is a type of social engineering. Instead of hacking a computer system directly, the attacker hacks your attention and trust. The email pretends to be from your bank, a delivery company, Microsoft, Google, HMRC, or even your boss.

The message usually creates a reason for you to act fast. Your account will be closed, a parcel is stuck, a payment failed, or someone tried to sign in. That pressure is deliberate. When you feel rushed, you are less likely to check the details.

When you click the link, you land on a fake website that looks almost identical to the real one. If you enter your username and password there, the criminal captures them instantly and can then sign in to your real account.

The Most Common Types of Phishing

Not all phishing looks the same. General phishing is sent to thousands of people at once with a generic greeting like “Dear Customer.” Spear phishing is more targeted and may use your real name, job title, or a recent order you actually placed.

Other forms include invoice scams sent to businesses, password reset scams, and delivery notification scams. Attackers also use text messages and voice calls with the same tricks, but email remains the most common starting point.

How to Spot a Fake Email: A Step-by-Step Check

Before you click, reply, or open an attachment, run through this short process. It takes less than thirty seconds once it becomes a habit.

1. Check the sender address, not just the name. An email may show “PayPal Support” as the name, but the actual address might be support@paypa1-secure-login.com. On mobile, tap the sender name to reveal the full address.
2. Look at the greeting. Legitimate companies that know you usually use your name. A vague greeting is not proof of a scam on its own, but combined with other signs it is a warning.
3. Watch for urgency and threats. Phrases like “act now,” “your account will be suspended in 24 hours,” or “legal action will follow” are classic pressure tactics designed to stop you thinking.
4. Hover over links before you click. On a computer, hover your mouse over the link to see the real destination. On a phone, press and hold carefully without opening it. If the address looks misspelled or unrelated, do not proceed.
5. Check spelling, grammar, and design. Many fake emails have awkward phrasing, inconsistent logos, or low-quality images. Modern scams are better written than before, so perfect grammar does not guarantee safety, but mistakes are still a useful clue.
6. Be suspicious of attachments. Never open an unexpected attachment, especially ZIP files, Word documents that ask you to enable macros, or PDF invoices you were not expecting.
7. Verify through a separate channel. If the email claims to be from your bank or workplace, open the official app or type the website address yourself. You can also call the number on the back of your bank card.

Slowing down removes most risk.

Red Flags That Should Stop You Immediately

Some warning signs are strong enough that you should delete or report the email right away. A request for your full password, PIN, or one-time verification code by email is a major one. No legitimate bank or email provider will ask for those details that way.

Another red flag is a mismatch between the link text and the link destination. For example, the email shows a familiar website name, but the hidden link points to a completely different domain with extra words, numbers, or hyphens.

Unexpected payment requests are also dangerous. If you receive an invoice, a refund notice, or a change of bank details from a supplier, confirm it by phone using a number you already know. Our guide to staying safe online with everyday cyber security habits covers more checks you can build into your routine at home and at work.

Why Phishing Still Works on Smart People

Phishing does not succeed because victims are careless. It succeeds because attackers exploit normal human behaviour. We are busy, we check email on small phone screens, and we receive dozens of legitimate alerts every week that look similar to the fakes.

Criminals also copy real branding extremely well and sometimes use compromised accounts from people you know. If a message comes from a colleague’s real account but the request is unusual, such as buying gift cards urgently, treat it as suspicious and verify it another way.

The Federal Trade Commission provides clear guidance on how to recognise and avoid phishing scams, including examples of common messages that should never be trusted at face value.

What to Do If You Clicked or Replied

If you interacted with a phishing email, act quickly but do not panic.

1. Disconnect and stop. If you opened an attachment on a work device, disconnect from Wi-Fi if instructed by your IT team and contact them immediately.
2. Change your password from a safe device. Go directly to the official website, not through the email link, and set a strong, unique password. If you reused that password elsewhere, change it there too.
3. Turn on two-factor authentication. Add an extra verification step wherever possible so a stolen password alone is not enough to break in.
4. Check your account activity. Review recent sign-ins, sent emails, forwarding rules, and bank transactions. Attackers sometimes add a forwarding rule to hide their activity.
5. Contact your bank if financial details were shared. Explain what happened and ask them to monitor or freeze transactions if needed.
6. Report the email. Use the report phishing button in your email app and forward the message to your provider if they offer a reporting address.

How to Protect Yourself Long Term

Good protection is layered. Start with unique passwords for every important account and store them in a reputable password manager. That way, if one password is stolen, your other accounts stay safe. Keep your browser, phone, and email app updated too.

Be careful with what you share publicly on social media. Details about your workplace, travel, or recent purchases help attackers craft more believable targeted emails. The Cybersecurity and Infrastructure Security Agency also stresses this layered approach in its advice on avoiding social engineering and phishing attacks.

Common Mistakes People Make With Suspicious Emails

The most common mistake is clicking first and checking later. Once you are on a fake login page that looks perfect, it is much harder to notice the danger. Always check before you click, not after.

Another mistake is trusting the display name alone. Your email app may show only a friendly name, hiding a strange address underneath. Make it a habit to reveal the full address for any message that asks you to take action.

People also reply to the email to ask if it is real. That confirms your address is active and may lead to more convincing follow-up scams. Verify through the official website, app, or a known phone number instead.

Conclusion

Phishing emails are designed to look urgent, familiar, and harmless enough to click without thinking. Your best defence is a calm, repeatable check: verify the sender, inspect links, question urgency, and go directly to official websites instead of using email links.

You do not need to be a security expert to stay safe. You just need to slow down for a few seconds and trust that pause. Share this checklist with family members too, especially anyone who is new to online banking or shopping. A little awareness today can prevent a major headache tomorrow.

Frequently Asked Questions

Can a phishing email infect my device without me clicking anything?

In most cases, you need to click a link, open an attachment, or enter information for the attack to succeed. Simply receiving or previewing an email is usually low risk if your software is up to date, but you should still delete suspicious messages without interacting with them.

What should I do with a phishing email?

Do not click links or open attachments. Use the report phishing or report spam option in your email app, then delete the message. If it impersonates your bank or workplace, let that organisation know through its official contact channels as well.

How can I tell if a link is safe on my phone?

Press and hold the link to preview the full web address without opening it, if your app supports that feature. If the domain looks misspelled, overly long, or unrelated to the sender, close the preview and visit the official app or website directly instead.

Do banks ever send emails asking me to verify my account?

Banks may send general alerts, but they should never ask you to enter your full password, PIN, or one-time code through an email link. If you are unsure, open your banking app directly or call the number on your card to check.

Is phishing only done by email?

No. The same tricks are used in text messages, social media messages, fake adverts, and phone calls. The core defence is the same everywhere: be wary of urgent requests, verify the sender independently, and never share codes or passwords with someone who contacted you unexpectedly.