How to Spot a Phishing Email: 9 Warning Signs
Phishing emails pretend to come from someone you trust – your bank, a delivery company, a streaming service, your own IT department – to get you to click a link, open a file or hand over a password or code. They used to be easy to spot thanks to clumsy spelling and odd design. Today, many are polished and well written.
The good news: even convincing phishing emails tend to give themselves away in the same few places. Here are nine warning signs worth checking every time.
1. Pressure to act right now
“Your account will be suspended in 24 hours.” “Unusual sign-in detected – verify immediately.” “Final notice.” Urgency is the most common phishing tool because it pushes you to act before you think. Real companies rarely threaten to close your account by email, and they don’t need you to react within minutes.
Tip: when an email makes you feel rushed, that’s your cue to slow down.
2. The sender’s address doesn’t match the name
Email apps show a friendly display name – “Netflix Support”, “PayPal” – which anyone can type. The real address is what matters. Look for:
- free email providers used by a “company”;
- lookalike domains such as
paypa1-security.com,amaz0n-orders.netorapple.id-verify.com; - a well-known brand name buried inside a different domain (
microsoft.account-alerts.example).
Read the domain from right to left: the last two parts (in the example above, account-alerts.example) are
who really sent the email – anything in front of them can be made up.
3. Links that go somewhere else
The text of a link can say anything. What counts is where it actually leads. Before clicking, hover over the link on a computer or long-press it on a phone to preview the destination.
Be suspicious of addresses that don’t match the company, use lots of random characters, or are hidden behind a link shortener. In TempMaily, the Open link button shows the destination’s domain next to it, so you can see where you’re about to go.
4. A login page reached from an email
The goal of most phishing is a fake sign-in page that looks exactly like the real one. If an email asks you to “log in to confirm”, don’t use the link. Open a new tab, type the company’s address yourself (or use your bookmark or app), and sign in there. If there’s really a problem with your account, you’ll see it.
5. A verification code you didn’t ask for
If you receive a one-time code you didn’t request, someone may be trying to sign in to your account – or set up a scam. A common trick goes like this: a criminal triggers a code to your email or phone, then contacts you pretending to be support, a buyer or a friend, and asks you to “read back the code”.
Never share a verification code with anyone. Legitimate services will never ask you for it – the code is only ever meant to be typed into the site or app where you requested it.
6. Requests for passwords, payment or personal details
Banks, tax authorities and online stores don’t ask you to reply with your password, card number or ID documents by email. Requests for gift cards, cryptocurrency or a “small fee” to release a parcel are almost always scams.
7. Unexpected attachments
Invoices you don’t recognise, “scanned documents”, shipping labels and voicemail files are classic ways to deliver malware. Don’t open attachments you weren’t expecting, even if they seem to come from someone you know – their account may have been compromised. (TempMaily removes all attachments from incoming mail for exactly this reason.)
8. Something feels off
Generic greetings like “Dear customer”, a logo that looks slightly wrong, a signature that doesn’t match how the company normally writes, an offer that seems too good to be true – any one of these can be innocent, but together they add up. Trust your instincts: if an email feels strange, treat it as suspicious until proven otherwise.
9. Pressure to switch channels
Some phishing emails ask you to continue the conversation somewhere else: “reply on WhatsApp”, “call this number”, “text us your details”. Moving you off email makes the scam harder to trace and easier to run. Only contact a company through the details on its official website or app.
What to do if you’re not sure
- Don’t click, don’t reply, don’t download. Close the email.
- Go to the source. Visit the company’s website or app directly, or call the number on the back of your card or on their official site.
- Report it. Most email apps have a “Report phishing” or “Report spam” option, and many companies publish an address for forwarding suspicious emails.
- If you already clicked or entered details, change the password for that account (and anywhere you reused it), turn on two-factor authentication, and contact your bank if you shared payment details.
A note on temporary inboxes
Disposable addresses attract their share of junk mail, so the same rules apply in a TempMaily inbox. A temporary address is great for one-off sign-ups, but it’s never a place to enter passwords or payment details because of an email you didn’t expect. Our eight rules for using temp mail safely cover the rest.
Phishing works by catching people in a hurry. Taking ten seconds to check the sender, the link and the request is usually all it takes to stay safe.