Signs of Phishing Emails
The specific warning signs that separate a phishing attempt from a legitimate message, with real-world example patterns.
Table of contents
Phishing remains one of the most common ways attackers gain access to accounts, and modern phishing emails have gotten considerably harder to spot than the broken-English scams of the past. This guide walks through the specific, concrete warning signs that separate a phishing attempt from a legitimate message — the kind of detail-level signals that hold up even against well-written, AI-assisted scam emails.
What is phishing?
Phishing is a message — usually email, though also text message ("smishing") or phone call ("vishing") — designed to trick you into revealing credentials, payment information, or granting access, by impersonating a trusted sender such as a bank, delivery company, employer, or colleague.
Sender address red flags
The display name on an email can say anything the sender wants — always check the actual email address behind it.
- Look for small misspellings in the domain, such as "micros0ft.com" or "paypa1.com".
- Watch for a legitimate-looking name paired with an unrelated domain, such as a message claiming to be from your bank but sent from a generic email provider.
- Be cautious of extra subdomains designed to look official, like "security-update.accountverify.com".
Urgency and pressure tactics
Phishing relies on making you act before you think. Common pressure tactics include:
- "Your account will be suspended in 24 hours."
- "Unusual sign-in detected — verify immediately."
- "Payment failed — update your billing information now to avoid service interruption."
Legitimate organizations rarely demand instant action through email alone, especially not for account-threatening consequences. When a message pushes urgency hard, that pressure is itself the warning sign.
Suspicious links and attachments
- Hover over (don't click) any link to preview the actual destination URL before clicking, on desktop browsers.
- Be cautious of shortened links (like bit.ly) in unsolicited messages, since they hide the real destination.
- Unexpected attachments, especially .zip, .exe, or macro-enabled Office documents, are a common malware delivery method — don't open them from unverified senders.
- If in doubt, navigate to the company's website directly by typing the address yourself, rather than clicking the link in the message.
Brand and colleague impersonation
Two specific impersonation patterns are worth knowing:
Brand impersonation
A message copies a well-known company's logo, colors, and tone closely, directing you to a fake login page that captures your credentials when entered.
Business email compromise
An attacker impersonates a colleague or executive — sometimes after actually compromising a real account — to request a wire transfer, gift cards, or sensitive files. These often specifically request confidentiality ("don't mention this to anyone yet") as an added pressure tactic.
Real-world example patterns
- A "delivery failed" notification asking you to click a link and pay a small redelivery fee.
- A fake invoice attachment from an unfamiliar vendor, asking you to open it to review charges.
- An email claiming to be from IT, asking you to "verify" your password through a linked form.
- A message claiming your cloud storage is full, with a link to a fake login page to "upgrade."
What to do when you spot one
- Don't click any links or open attachments.
- Report it using your email provider's "report phishing" option, if available.
- Delete the message, or keep it only if your organization has a specific reporting process.
- If it impersonates a company you have an account with, verify directly by visiting their official site or app — never through the message's own link.
If you already clicked a link or entered credentials
- Change the password for the affected account immediately, from a device you trust.
- Enable multi-factor authentication if it wasn't already on — see our guide on how multi-factor authentication works.
- Change the password anywhere else you reused it.
- Run a malware scan if you downloaded or opened an attachment.
- Monitor the affected account closely for a few weeks for unusual activity.
External references
Conclusion
Modern phishing emails can look polished and professional, but the underlying tactics stay consistent: manufactured urgency, a mismatched sender address, and a link or attachment designed to capture your credentials or install malware. Slowing down for ten seconds to check the sender's actual address and navigate to sites directly, rather than through a message's link, defeats the overwhelming majority of phishing attempts.
Frequently asked questions
Are phishing emails always poorly written now?
No. AI-assisted writing tools have made many phishing emails grammatically flawless, which is why the sender address and urgency tactics matter more than writing quality as warning signs.
Is it safe to unsubscribe from a suspicious email?
Generally, only unsubscribe from senders you recognize. For unknown or suspicious senders, unsubscribing can sometimes confirm your address is active; it's usually safer to simply delete and report the message.
Can phishing happen over text message or phone calls too?
Yes — these are called smishing (text) and vishing (voice) and use the same core tactics of urgency and impersonation.
What if a phishing email appears to come from someone I know?
Their account may have been compromised. Verify through a different channel, like a phone call, before acting on any unusual request, especially one involving money or sensitive files.
Do phishing filters catch everything?
No filter is perfect. Email providers block a large share of obvious phishing, but well-crafted or newly created scam campaigns can still get through, which is why recognizing the signs yourself still matters.