How to Spot a Phishing Email: 15 Warning Signs You Should Never Ignore

Phishing emails are designed to look trustworthy while secretly trying to trick you into clicking a malicious link, opening an unexpected attachment, sharing sensitive information, or sending money. The most convincing phishing messages may appear to come from a bank, employer, delivery company, online service, or even someone you know.

The good news is that you don’t need to be a cybersecurity expert to recognize many phishing attempts. By learning a few common warning signs—and developing the habit of stopping to verify unexpected requests—you can significantly reduce your chances of falling for an email scam.

In this guide, you’ll learn how to spot a phishing email, the 15 warning signs to watch for, how to safely check a suspicious message, what to do if you accidentally click a phishing link, and how to protect your accounts in the future.

What Is a Phishing Email?

A phishing email is a deceptive message designed to persuade the recipient to take an action that benefits a scammer. The goal may be to steal passwords or financial information, obtain access to an account, deliver harmful software, or trick someone into transferring money.

Phishing messages commonly impersonate organizations or people the recipient trusts. The FTC notes that scammers often pretend to represent companies such as banks, utilities, payment services, or other familiar organizations. They may claim there is a problem with an account, request confirmation of personal information, or encourage the recipient to click a link or open an attachment.

Phishing also overlaps with spoofing, in which a scammer disguises an email address, sender name, website URL, or another identifying detail to make a communication appear legitimate.

15 Warning Signs of a Phishing Email

Not every suspicious email will contain every warning sign. However, several red flags appearing together should make you stop and verify the message before taking action.

1. The Email Creates a Strong Sense of Urgency

One of the most common phishing tactics is pressure.

A suspicious email may tell you:

• Your account will be closed today.
• You must pay immediately.
• Your password will expire soon.
• You need to verify your identity right now.
• A transaction requires immediate confirmation.

The purpose is to make you act before you have time to think.

Urgency isn’t proof that an email is fraudulent, but it is an important reason to slow down. The FBI identifies unexplained urgency and pressure to act quickly as common fraud warning signs.

Best practice: Don’t let an email’s deadline determine your response. Verify the request independently first.

2. The Sender’s Email Address Looks Suspicious

Never judge an email only by the sender’s displayed name.

A message might display a familiar company or person’s name while using an unrelated or slightly altered email address.

Look carefully for:

• Misspelled domains
• Extra letters or numbers
• Unusual characters
• Unexpected domains
• Addresses that don’t match the organization being claimed

The FBI specifically recommends carefully examining email addresses, URLs, and spelling because scammers can make small changes that deceive recipients.

For example, an address that looks almost identical to a legitimate business address deserves additional verification.

3. The Email Contains a Suspicious Link

Phishing emails frequently try to move you from your inbox to a website controlled by the attacker.

Be cautious when an unexpected message asks you to:

• Log in
• Verify your account
• Update payment information
• Confirm your identity
• Download something

Don’t assume a link is safe simply because the email contains familiar branding.

Instead, if you believe the message might be legitimate, visit the organization’s official website independently or use a trusted contact method. The FTC recommends avoiding unexpected links and contacting companies through information you know is genuine.

4. The Message Requests Sensitive Information

Be especially cautious when an unexpected email asks for information such as:

• Passwords
• Banking information
• Credit card details
• Security codes
• Account credentials
• Other sensitive personal information

A phishing message may create a believable reason for requesting this information—for example, claiming that your account needs to be “verified.”

The FBI advises that companies generally don’t contact people to request usernames or passwords.

When an unexpected message requests sensitive information, stop and verify it through an independent channel.

5. The Email Contains an Unexpected Attachment

Unexpected attachments deserve careful attention.

A message might claim to contain:

• An invoice
• A delivery document
• A receipt
• An account statement
• A business document
• A form

If you weren’t expecting the file, don’t open it simply because the email looks professional.

The FTC warns that suspicious attachments can potentially lead to harmful software, while the FBI recommends being cautious with attachments from unknown senders.

6. The Greeting Is Generic or Unusual

A phishing email may use a generic greeting such as “Dear Customer” or “Dear User.”

However, this is an important distinction: a generic greeting by itself does not prove that an email is phishing.

Some legitimate companies use automated messages, so consider the greeting alongside other clues such as the sender address, request, links, and context.

The FTC includes generic greetings among the signs that can help reveal a fake message.

7. The Message Contains Unusual Spelling or Grammar

Poor spelling, strange sentence construction, inconsistent capitalization, or awkward wording can be warning signs.

However, grammar should never be your only test. Modern scams can be professionally written, and legitimate businesses can occasionally send messages containing mistakes.

Instead of asking only, “Does this email have spelling mistakes?” ask:

Does the entire message make sense, and does it match what I would normally expect from this sender?

The FBI lists misspellings and poor grammar among common fraud red flags.

8. You Have Won Something You Never Entered

Unexpected prizes, refunds, rewards, coupons, or giveaways can be tempting.

A message might claim:

• You’ve won a prize.
• You’re eligible for a refund.
• You’ve received an unexpected reward.
• You have been selected for a special offer.

If you never entered a contest or requested a reward, treat the message with skepticism.

The FTC specifically warns about phishing messages that use fake refunds, coupons, and other tempting offers to encourage people to interact with them.

9. The Email Uses Fear or Threats

Some phishing emails attempt to frighten recipients into acting quickly.

For example, a scammer may claim that:

• Your account has been compromised.
• You owe an unexpected payment.
• Your account will be suspended.
• Legal action is imminent.
• You must act to avoid a serious consequence.

Fear can be just as effective as excitement in persuading someone to click.

When an email makes you anxious, slow down rather than speed up.

10. The Email Doesn’t Match Your Recent Activity

Context is one of the most powerful tools for spotting phishing.

Ask yourself:

• Did I actually place this order?
• Do I have an account with this company?
• Did I request a password reset?
• Was I expecting an invoice?
• Did I contact this organization recently?

If the answer is no, don’t assume the email is legitimate simply because it looks professional.

The FTC recommends asking whether you actually have an account with the organization or know the person who contacted you.

11. The Branding or Formatting Looks Wrong

Scammers can copy logos and familiar designs, but imitation isn’t always perfect.

Watch for:

• Poor-quality logos
• Strange fonts
• Inconsistent colors
• Misaligned text
• Unusual signatures
• Formatting that doesn’t resemble previous legitimate messages

Still, don’t rely entirely on visual appearance. A convincing logo doesn’t prove an email is genuine.

12. The Sender Asks You to Bypass Normal Procedures

Be suspicious when an email tells you not to follow your organization’s usual process.

For example, someone might ask you to:

• Keep the request secret
• Avoid calling them
• Use a new payment account
• Communicate through an unusual channel
• Ignore normal approval procedures

This is especially important in workplaces.

The FBI warns that business email compromise scams can involve fake requests to change payment details or send money under urgent circumstances. Independent verification is essential for unusual financial requests.

13. The Email Contains an Unusual Payment Request

Unexpected payment instructions are a major warning sign.

Be especially careful when an email suddenly asks you to:

• Pay an unfamiliar invoice
• Change bank details
• Purchase gift cards
• Send money using an unusual method
• Transfer funds urgently

If a legitimate business relationship is involved, verify payment changes using a previously known phone number or another trusted communication channel—not the contact information supplied in the suspicious email.

14. The Reply-To Address Looks Different

Sometimes the visible sender and the address that receives your reply may not match.

That can be a warning sign when the message is making an unexpected or sensitive request.

Before responding to an unusual email, verify the sender independently. Don’t assume that pressing “Reply” will necessarily contact the person or organization you think it will.

15. The Message Seems Too Good—or Too Scary—to Be True

Finally, trust your skepticism.

Unexpected prizes, effortless money, dramatic warnings, or extraordinary offers should all encourage you to pause.

The FBI has highlighted familiar fraud indicators such as urgency, secrecy, suspicious addresses, unexpected links or attachments, and offers that seem too good to be true.

The key isn’t to become suspicious of every email. It’s to recognize when a message deserves verification before you act.

Phishing Email vs. Legitimate Email: How to Tell the Difference

Feature	Potential Warning Sign	What to Do
Sender	Address doesn’t match the claimed organization	Verify independently
Links	Unexpected or suspicious	Don’t click
Attachments	Unexpected file	Don’t open it
Request	Password or sensitive information	Verify the request
Tone	Threatening or unusually urgent	Slow down
Payment	Unexpected payment instructions	Confirm through a trusted channel
Context	You weren’t expecting the message	Investigate before responding

Remember that legitimate-looking branding, correct spelling, or a familiar display name does not guarantee authenticity.

How to Check a Suspicious Email Safely

If you’re unsure whether an email is real, use this simple process.

Step 1: Don’t Click Anything

Avoid clicking links, opening unexpected attachments, or replying until you’ve verified the message.

Step 2: Examine the Sender

Look at the complete email address rather than only the displayed name.

Step 3: Consider the Context

Ask whether you actually expected the email.

Step 4: Verify Independently

If the message claims to be from a bank, company, school, service, or another organization, find its official website or contact information yourself.

Don’t use the phone number or link supplied by a suspicious message.

Step 5: Report the Message

Use your email provider’s phishing-reporting feature or report it through the appropriate organization.

The FTC recommends reporting phishing attempts and deleting the message after you’ve dealt with it.

What to Do If You Accidentally Clicked a Phishing Link

Don’t panic, but don’t continue interacting with the message.

If you clicked a suspicious link:

1. Stop interacting with the message.
2. Don’t provide additional information.
3. If you entered a password, change it through the legitimate website.
4. Enable multi-factor authentication where available.
5. If you downloaded something suspicious, follow your device or security software’s recommended scanning procedures.
6. Notify a trusted adult, parent/guardian, school IT team, or workplace security team as appropriate.
7. Report the phishing attempt.

The FTC recommends updating security software and running a scan if you believe a suspicious link or attachment may have downloaded harmful software.

If financial or highly sensitive information was provided, contact the relevant organization using independently verified contact information as soon as possible.

How to Report a Phishing Email

Reporting phishing helps organizations identify scams and improve their defenses.

Depending on where you live and what service you use, you may be able to:

• Use your email provider’s “Report phishing” option.
• Report the message to your organization’s IT or security team.
• Contact the organization being impersonated.
• Report the scam to an appropriate government agency.

For U.S. consumers, the FTC accepts reports through ReportFraud.ftc.gov, and phishing emails can also be forwarded to the Anti-Phishing Working Group at reportphishing@apwg.org. The FBI directs victims of internet-enabled crime to its Internet Crime Complaint Center, IC3.

If you’re outside the United States, use your country’s official cybercrime or consumer-protection reporting service.

How to Prevent Phishing Attacks

Recognizing phishing is important, but prevention is even better.

Use Multi-Factor Authentication

MFA adds another verification step when you sign in. The FBI recommends enabling two-factor or multi-factor authentication on accounts that support it.

Keep Software Updated

Install security updates for your operating system, browser, email applications, and security software.

Use Email Filters

Spam and phishing filters can prevent many suspicious messages from reaching your main inbox. Still, no filter catches everything, so stay alert.

Verify Unexpected Requests

Be particularly careful with requests involving:

• Money
• Passwords
• Account changes
• Security codes
• Personal information

Develop a “Stop, Check, Verify” Habit

When an email feels unusual:

Stop. Don’t act immediately.

Check. Examine the sender, message, links, attachments, and context.

Verify. Confirm the request through a trusted channel.

Common Types of Phishing Emails

Phishing can take many forms. Some common examples include:

• Credential phishing: Attempts to steal usernames and passwords.
• Account verification scams: Claims that an account needs immediate verification.
• Password reset scams: Fake password-reset requests.
• Invoice scams: Fake bills or payment requests.
• Delivery scams: Messages about supposedly missed or delayed packages.
• Banking scams: Messages pretending to come from financial institutions.
• Prize scams: Fake winnings or rewards.
• Business email compromise: Messages impersonating executives, vendors, employees, or business partners.

The FBI describes business email compromise as a particularly damaging form of fraud because criminals can impersonate trusted sources and manipulate legitimate business processes.

Phishing Email Examples: What Red Flags Should You Look For?

Consider these fictional examples:

Example 1: Fake Account Alert

“Your account will be suspended today. Click here immediately to verify your information.”

Red flags: urgency, unexpected link, sensitive-information request.

Example 2: Fake Delivery Notice

“Your package could not be delivered. Pay a small fee using this link.”

Red flags: unexpected delivery, payment request, suspicious link.

Example 3: Fake Invoice

“Your invoice is attached. Payment is overdue. Please pay today.”

Red flags: unexpected attachment, urgency, unfamiliar transaction.

Example 4: Fake Password Reset

“We detected suspicious activity. Click here immediately to reset your password.”

Red flags: fear, urgency, login link.

The exact wording of phishing messages changes constantly, so learning the underlying warning signs is more useful than memorizing specific examples.

Phishing vs. Spam vs. Spoofing: What’s the Difference?

These terms are related but aren’t identical.

Phishing is a deceptive attempt to trick someone into giving information, clicking something, or taking another action.

Spam generally refers to unwanted bulk messages. Spam isn’t necessarily designed to steal information, although spam and phishing can overlap.

Spoofing involves disguising an email address, sender identity, URL, or other information so it appears to come from a trusted source.

Understanding the difference helps you recognize why a message can look legitimate even when it isn’t.

Frequently Asked Questions About Phishing Emails

What are the biggest warning signs of a phishing email?

Common warning signs include unusual urgency, suspicious sender addresses, unexpected links or attachments, requests for sensitive information, unusual payment instructions, and messages that don’t match your recent activity.

How can I tell if an email is fake?

Check the sender address, context, links, attachments, tone, and requested action. When in doubt, independently contact the organization using information you know is legitimate.

Can a phishing email look completely legitimate?

Yes. Phishing messages can imitate trusted organizations and use convincing branding. That’s why you shouldn’t rely on appearance alone.

Should I reply to a suspicious email?

Generally, don’t reply until you’ve independently verified who sent it and why. A suspicious message should be handled through your email provider’s reporting tools or another trusted channel.

What happens if I click a phishing link?

The consequences vary. You might be taken to a fake website, asked to provide sensitive information, or potentially exposed to harmful software. If you clicked a suspicious link, stop interacting with the message and take appropriate security steps.

How can I verify an email sender?

Look at the complete sender address and independently contact the claimed organization or person using a trusted website, phone number, or existing communication channel.

Are phishing emails always poorly written?

No. Spelling and grammar mistakes can be clues, but polished writing does not prove that a message is legitimate.

Phishing Email Safety Checklist

Before interacting with an unexpected email, ask:

• ☐ Do I recognize the sender?
• ☐ Does the complete sender address look legitimate?
• ☐ Was I expecting this message?
• ☐ Does it create unusual urgency?
• ☐ Is it asking for sensitive information?
• ☐ Does it contain an unexpected link?
• ☐ Does it contain an unexpected attachment?
• ☐ Is there an unusual payment request?
• ☐ Does the message match my recent activity?
• ☐ Can I verify the request independently?

If several answers raise concerns, stop before taking action.

Final Takeaway: Stop, Check, and Verify

Learning how to spot a phishing email doesn’t require advanced technical knowledge. It starts with recognizing patterns.

Watch for suspicious sender addresses, unexpected links, attachments, urgent demands, requests for sensitive information, unusual payment instructions, and messages that don’t fit your circumstances.

Most importantly, don’t let pressure make the decision for you.

Remember:

Stop → Check → Verify

Stop before clicking. Check the message carefully. Verify unexpected requests through a trusted channel.

Phishing tactics will continue to change, but careful digital habits remain one of your strongest defenses. The next time an unexpected email lands in your inbox, take a few extra seconds to examine it before you act.

Have you ever received an email that looked legitimate but turned out to be suspicious? Share the warning sign that helped you recognize it—your experience could help someone else avoid a scam.