How to Spot a Phishing Email: 12 Red Flags and Examples

To spot a phishing email, slow down and check five things: the sender's real address (not just the display name), where the links actually lead, whether the message rushes or scares you, whether it asks for a password, payment or personal information, and whether you were expecting it at all. If anything feels off, don't use the links, attachments or phone numbers in the email. Go to the company's website or app yourself, or call a number you already trust.

Below: the 12 red flags in one table, three example emails broken down, what to do if you already clicked, and where to report phishing in the United States. All companies, addresses and phone numbers in the examples are fictional.

The 3-question test before you click anything

You don't need to be technical. You need a pause and three questions:

If any answer is yes, switch to verification mode: inspect the sender and links as shown below, or contact the organization through a channel you know is real.

12 red flags of a phishing email

One red flag doesn't always mean phishing, but two or three together, especially with a request for a login or money, is your signal to stop.

How to check the sender and links without clicking

Read the full sender address

Anyone can type any display name. What matters is the domain after the @ sign. A message from "Larkmoor Bank" sent from alerts@larkmoor-bank-notices.com is not from larkmoorbank.com, however official the logo looks. On a phone, tap the name to see the address.

Read a link from right to left

Preview the link first (hover on a computer, press and hold on a phone), then find the part just before the first single slash and read it from right to left. The real website is the name right before the ending (.com, .net, .org):

https://www.larkmoorbank.com/alerts           → larkmoorbank.com (the real bank, in this example)
https://larkmoorbank.com.account-check.net/login → account-check.net (not the bank)
https://larkmoor-bank-support.com/verify      → larkmoor-bank-support.com (not the bank)
https://www.larkrnoorbank.com/login           → "rn" pretending to be "m" (not the bank)

Anything left of the real name is a subdomain, which the site owner can set to anything, including your bank's name. Shortened links hide the destination entirely, so treat them as suspicious.

Use the warnings your email app already gives you

Notice banners such as "Be careful with this message" or "External sender," and labels like "via" next to the sender. Options such as "Show original" or "View message source" reveal whether the message passed the SPF, DKIM and DMARC authentication checks. A failure is a strong warning sign. A pass only proves the email came from that domain, and a scammer's look-alike domain can pass too, so still read the domain itself.

Three phishing email examples, broken down

Example 1: "Your password expires today"

Imagine you work at Quillmont Dental Group, whose real domain is quillmontdental.com. Hovering over the button shows https://quillmontdental.com.mail-keepaccess.net/login. Here's what gives it away:

• Sender domain: quillmont-dental-support.com is not your company's domain, and IT teams send from their own.
• Link destination: read right to left, the real site is mail-keepaccess.net.
• The request makes no sense: password policies ask you to change a password inside your account, never to "confirm" your current one on a web form.
• The threat: 24 hours or you're locked out.

Safe move: don't click. Open your email or company portal the way you always do; if your password really needs changing, you'll see it there. Report the message to IT. A password manager helps too: it won't autofill your password on a fake domain.

Example 2: The small delivery fee

This works because many of us really are waiting for a package. The red flags:

• The fee is tiny on purpose. The goal is your full card number, expiration date and security code, typed into a fake payment page.
• The domain: trovex-redelivery.info is not the carrier's website (here, trovexparcel.com).
• The tracking number matches no order confirmation you received.
• The deadline: 48 hours, or your package disappears.

Safe move: open the order confirmation from the store where you bought something and track the package from there, or type the carrier's official address into your browser. Then report and delete the email.

Example 3: The fake renewal with a phone number

Notice there's no link at all. This is callback phishing: the email just needs you to call. On the phone, a friendly "agent" may ask you to install remote access software "to process the refund" or to log in to your bank while they watch. The red flags:

• You don't have this product, or you never pay for it this way.
• A company invoice sent from a free webmail account.
• A large charge designed to cause panic, with a 24-hour deadline.
• The only way to "fix" it is a phone number inside the email.

Safe move: check your statement in your bank's app. If a charge looks wrong, call the number on the back of your card. Never give remote access to someone you reached through an unexpected email or call.

Real email or phishing? A side-by-side

What to do if you clicked a link or opened an attachment

A click doesn't always mean you've been hacked, but act quickly. What to do depends on what happened after the click:

1. Right awayStop and close the pageDon't type anything else. If a download started, cancel it and don't open the file.
2. If you typed a passwordChange it from the real siteType the address yourself. Change it anywhere you reused it, turn on multi-factor authentication (MFA), sign out of other sessions and check your recovery email, phone number and forwarding rules.
3. If you opened a fileDisconnect and get helpTake the device off Wi-Fi or the network. At work, call IT immediately. At home, update your system and run a full scan with your security software.
4. If you entered card or bank detailsCall your bankUse the number on the back of your card or in your banking app. Ask them to block the card and watch for or dispute fraudulent charges.
5. If you shared your SSN or ID detailsProtect your identityUse IdentityTheft.gov, the FTC's site, to get a recovery plan, and freeze your credit at Equifax, Experian and TransUnion. Freezes are free.
6. The same dayReport itUse the channels in the next section, and warn your contacts if your account sent messages you didn't write.

How to report a phishing email in the U.S.

Reporting helps take fake sites down. Where to report depends on your situation:

Then delete the message.

How to make phishing much harder to fall for

• I use a password manager. It fills passwords only on the real site, so if autofill doesn't work where it normally would, I stop and check the address.
• MFA is on for my email, bank and work accounts, and I use passkeys or security keys where they're offered, since they resist phishing.
• I bookmarked the sites I log in to most (bank, payroll, benefits, email) and use the bookmarks instead of email links.
• My phone, computer, browser and email app install updates automatically.
• Any request to send money or change bank details gets a phone call to a number I already have.
• I froze my credit at the three bureaus because I'm not applying for new credit soon.

Set these up with our lessons on passwords, password managers and MFA and privacy and personal data protection, which covers credit freezes step by step.

Common mistakes

Frequently asked questions

Can you get hacked just by opening a phishing email?
Opening an email in an up-to-date email app is generally low risk. The danger comes from what you do next: clicking links, opening attachments, enabling content, replying or calling a number. Loaded images can tell the sender your address is active, so some people turn off automatic image loading.

What's the difference between spam and phishing?
Spam is unwanted bulk email, often just aggressive marketing. Phishing pretends to come from someone you trust to steal your login, money or personal information.

What should I do if a phishing email came from someone I know?
Their account may have been hacked, or someone may be faking their address. Don't reply to the email. Contact them through another channel you already have, such as a phone call or text, and let them know so they can secure their account.

Should I reply to a phishing email to tell them I know it's a scam?
No. Replying confirms that a real person reads your address, which can bring more scam messages. Report it and delete it.

Phishing emails are only one form of social engineering. Learn the psychological triggers scammers use, plus text, phone and QR code scams and business email compromise, in our lesson on phishing and social engineering.

Want to protect your accounts, devices and business step by step? Our free cybersecurity course covers phishing, passwords and MFA, home Wi-Fi, backups and incident response in 16 beginner-friendly lessons, with a downloadable security checklist.