How to spot a phishing email

Phishing works because it looks like ordinary email: a password reminder, an invoice, a quick favor for your boss. You won't catch every one by instinct, but a short, repeatable check catches most. This guide lists the warning signs that official sources agree on, then walks through three realistic examples and annotates every red flag.

What is a phishing email?

A phishing email tries to get you to do something that helps a criminal: type a password into a fake page, open a malicious file, pay a fake invoice, or reply with sensitive data. Many phishing emails also use spoofing, which Microsoft describes as messages that "appear to originate from someone or somewhere other than the actual source."

The UK's National Cyber Security Centre (NCSC) sums up the tricks scammers use in five words: authority, urgency, emotion, scarcity and current events. Is the message claiming to be from someone official? Are you told you have limited time? Does it make you panic, fearful, hopeful or curious? Keep those five in mind as you read the signs below.

What are the warning signs of a phishing email?

These signs come from the FTC, CISA and Microsoft. One sign alone proves little. Two or three together should stop you.

The FTC lists the stories scammers tell most often. They "say they've noticed some suspicious activity or log-in attempts", claim "there's a problem with your account or your payment information", "include an invoice you don't recognize", or want you "to click on a link to make a payment." If an email fits one of those stories, slow down.

What about spelling and grammar?

Microsoft still lists obvious spelling and grammar errors as a sign. They're no longer reliable on their own, because criminals use writing tools to produce clean text. Our guide to AI phishing emails explains what has changed. Treat a typo as a bonus clue, not a requirement.

How do you check the real sender?

The name you see in your inbox is the display name. Anyone can set it to anything. Always look at the address behind it.

1. Expand the sender. On a computer, click or hover over the name. On a phone, tap it.
2. Read the domain, the part after the @. Is it the company's real domain, or a free mail service, or something close but not quite right? Microsoft gives examples such as "micros0ft.com", where an "o" became a zero, and "rnicrosoft.com", where "m" became "r" and "n". Our guide to lookalike domain phishing covers more tricks.
3. Check the reply-to. If you hit Reply and the address changes, the sender wants answers to go somewhere else.
4. Notice your mail app's warnings. Microsoft 365 can show a question mark on the sender's picture or say it couldn't verify the sender when authentication fails. Microsoft also says to take extra care with messages from unfamiliar senders, especially those marked "[External]".

A real address doesn't make a message safe. If a supplier's mailbox is hacked, the phishing arrives from their genuine account. For a deeper look, paste the headers into the free Email Header Analyzer, which runs in your browser, and read our guide on how to read email headers.

How do you check a link without clicking it?

Microsoft's advice is to hover the mouse over the link without clicking and ask whether the address that pops up matches the link in the message. On a phone, press and hold the link to preview it.

When you read the address, find the domain just before the first single slash. In https://login.microsoftonline.com.secure-check.example/reset, the real domain is secure-check.example, not Microsoft. The words on the left are decoration.

CISA lists "untrusted shortened URLs" as a sign of phishing, because a shortener hides the destination. Links hidden in QR codes do the same thing and are usually scanned on a phone; see our guide to QR code phishing.

If a message might be real, don't use its link at all. Microsoft suggests opening a new tab and going to the organization's website from your own saved favorite or a web search.

Three phishing emails, annotated

The examples below are written for this guide. They're typical of what reaches business inboxes.

Example 1: the fake password expiry

From: IT Support Team <helpdesk@mail-365-support.example> Subject: ACTION REQUIRED: Your password expires today

Dear user, your mailbox password expires in 2 hours. To keep your messages, click below to keep your current password. [Keep my password]

• The display name says "IT Support Team", but the domain isn't yours or Microsoft's.
• "Dear user" is a generic greeting. Your own IT team knows your name.
• "Expires in 2 hours" is urgency. If your password really is expiring, you can change it by going to your usual sign-in page yourself.
• "Keep my current password" makes no sense as a security action. It exists to get you to a fake sign-in page.
• Hovering over the button shows a domain that has nothing to do with Microsoft.

Example 2: the invoice you don't recognize

From: Accounts <billing@yourvendor-invoices.example> Subject: Overdue invoice INV-20931, final notice

Please find attached the overdue invoice. Late fees apply from tomorrow. Open the secure document to view.

• An invoice you don't recognize is on the FTC's list of phishing stories. The FTC is blunt: "it's fake".
• "Final notice" and "late fees" add pressure.
• The domain adds a word to the real vendor's name.
• "Open the secure document" usually means an HTML file or a link to a fake sign-in page. See dangerous email attachment types.

If you do work with this vendor, call your usual contact. Our guide to fake invoice and payment emails covers renewal notices, domain and SEO invoices.

Example 3: the quick favor from the boss

From: Sam Rivera <sam.rivera.office@gmail.example> Subject: Are you at your desk?

I need a quick favor. I'm in meetings all day and can't talk. Please reply ASAP.

• The name is real; the address isn't. Your CEO uses the company domain.
• "Can't talk" blocks the one check that would expose the scam.
• No link and no attachment. There's nothing for a malware scanner to catch. The next email asks for gift cards or a wire.

Read more in our guides to boss gift card scams and business email compromise.

Phishing email checklist: 10 checks before you act

Use this whenever an email asks you to click, sign in, pay, download or reply with information.

1. Did I expect this message?
2. Does the sender's address, not just the name, match the organization?
3. Does Reply go to the same address?
4. Is it rushing me, threatening me, or asking me to keep it secret?
5. Is it asking for a password, a code, payment, gift cards or personal data?
6. Does every link, when I hover over it, go to the organization's real domain?
7. Was I expecting this attachment?
8. Is my mail app showing "External", a question mark or a "could not verify" warning?
9. Would this person normally ask for this, in this way?
10. Can I confirm it through a number or website I already know?

If any answer worries you, follow the FTC's rule: contact the company "using a phone number or website you know is real — not the information in the email."

What should you do with a phishing email?

• Don't click, reply or open attachments.
• Report it with your mail app's report button. Our step-by-step guide shows how to report a phishing email in Outlook, Gmail and Apple Mail, and to the authorities.
• At work, tell IT. One report can protect everyone else who received the same message.
• If you already clicked or typed a password, follow what to do after clicking a phishing link now.

How can a business see fewer phishing emails?

Training helps people spot what gets through. Fewer phishing emails reaching inboxes means fewer chances to click.

• Filter mail before it reaches the mailbox. A filter checks authentication, sender reputation, links and attachments. See how spam filters work.
• Turn on external sender tags so outside mail claiming to be internal stands out.
• Enforce DMARC on your own domain so criminals can't send exact-match spoofs of your address. Check yours with the DMARC Checker.
• Use MFA everywhere, so a stolen password alone isn't enough.

Next steps

1. Share the 10-point checklist above with your team, and agree on one way to report suspicious mail.
2. Run your domain through the free Email Health Check to see where SPF, DKIM and DMARC stand.
3. Learn the reporting steps in how to report a phishing email.
4. If you want phishing and spoofing filtering in front of every mailbox on a domain, see how iBlockSpam works.

A filter catches much of this before anyone has to judge it. See what iBlockSpam includes and how per-domain pricing works.

Browse our other phishing and threat guides.