How to Spot a Phishing Email: 12 Red Flags (With Real-Looking Examples)

What phishing actually is (in one minute)

Phishing is a message that pretends to come from someone you trust, such as your bank, a delivery company, Netflix, your boss or even a friend, so that you hand over something valuable. Usually that is a password, a one-time code, card details, or simply a click on a link that installs something nasty.

It works because it is cheap. A scammer can send a million emails for almost nothing, and if only a few people fall for it, it pays. So the emails are designed for speed: they want you to react before you think. Slowing down for ten seconds is honestly the single best defence you have, and the red flags below tell you what to look at during those ten seconds.

The 12 red flags

1. The sender's address does not match the company

The display name can say anything. "PayPal Support" is just text. What matters is the actual address after it. Tap or hover over the name to see it.

• Looks fine: [email protected]
• Red flag: [email protected]
• Red flag: [email protected]

Big companies send from their own domain. They do not email you from a free Gmail or Outlook address, and they do not bolt extra words like "secure", "verify" or "account" onto their name.

2. Lookalike spelling in the domain

Scammers register domains that look right at a glance: arnazon.com (r + n looks like m), paypa1.com (the number 1 instead of the letter l), or micros0ft.com (a zero instead of an o). On a small phone screen these are very hard to spot, which is exactly why they are used. Read the domain slowly, letter by letter.

3. Urgency and threats

"Your account will be closed in 24 hours." "Final notice." "Legal action will be taken." Real companies rarely give you a countdown by email. Urgency is there to stop you from thinking. Whenever an email makes you feel rushed or scared, treat that feeling itself as a warning sign.

4. The link goes somewhere else

The button might say "Log in to your account", but where does it really go? On a computer, hover over the link and look at the address in the bottom corner of the browser. On a phone, press and hold the link to preview it without opening it.

• The email says it is from your bank, but the link goes to secure-login-bank.xyz
• The link starts with the right name but the real domain comes later: https://netflix.com.account-update.info/login (the real site here is account-update.info, not Netflix)

5. A generic greeting

"Dear customer", "Dear user" or "Hello valued member". A company you have an account with normally knows your name. A generic greeting does not prove an email is fake, but combined with any other flag on this list it is a strong hint.

6. It asks for your password, a code or card details

This one is simple: no real bank, shop or email provider will ever ask you to reply with your password, your full card number or the one-time code they just texted you. That code exists precisely so that only you can use it. If anyone asks for it, by email, chat or phone, it is a scam. Every time.

7. An attachment you did not expect

"Invoice_0423.zip", "Payment_details.html", "Scanned_document.pdf.exe". Unexpected attachments, especially ZIP files, HTML files or anything that asks you to "enable editing" or "enable macros", are a classic way to install malware. If you were not expecting an invoice, do not open the invoice.

8. A deal that is too good to be true

"You have won an iPhone 16." "Claim your $500 gift card." "Your tax refund of $1,240 is waiting." You did not enter a competition, so you did not win one. These emails usually lead to a form that asks for your card details "to cover shipping".

9. Odd grammar and formatting (but do not rely on it)

Strange phrasing, random capital letters and blurry logos used to be the easiest giveaway. Today many phishing emails are written with AI tools and look perfectly polished. So treat bad grammar as a bonus clue, never as the main test. A well-written email can still be fake.

10. A reply-to address that is different from the sender

Some phishing emails come from a real-looking address but quietly set a different "reply-to". You press Reply, and your answer goes to the scammer. If you are about to reply with anything sensitive, check the address in the "To" field of your reply first.

11. Something you never signed up for

A shipping notice from a courier you have not used, a password reset you did not request, or a receipt for a purchase you did not make. Scammers send these hoping you will click to "cancel" or "dispute" the order. Do not use the email's link. If you are worried, open the company's app or type its address yourself.

12. Authentication warnings from your email app

Gmail, Outlook and Apple Mail check behind the scenes whether an email really came from the domain it claims. When those checks fail, you may see a warning like "This message may not be from who it says it is", or a question mark instead of the sender's photo. Take those warnings seriously. If you are curious how those checks work, I explain them in plain English in SPF, DKIM and DMARC explained.

A real-looking example, taken apart

Here is the kind of email that lands in inboxes every day:

From: Amazon Customer Service <[email protected]>
Subject: Action required: your order #112-8842 has been suspended

Dear Customer,
We were unable to verify your payment information. Your order and your account will be cancelled within 24 hours unless you confirm your details.

[Verify my account]

Let us count the flags:

1. The domain is amaz0n-orders-support.com, with a zero and extra words. Amazon does not send from there.
2. "Dear Customer" instead of your name.
3. A 24-hour threat.
4. An order you probably do not recognise.
5. A button that, if you pressed and held it, would point to some unrelated site.

Five flags in a few lines. The right move: delete it, or open the Amazon app yourself and look at your orders. If there really is a problem, you will see it there.

What to do if you already clicked

First: do not panic, and do not feel stupid. These emails are made by people whose full-time job is fooling others. What matters now is acting quickly:

1. If you only opened the email: you are almost certainly fine. Just delete it.
2. If you clicked the link but typed nothing: close the page. Run your device's security scan if you have one.
3. If you entered a password: change it immediately on the real website (type the address yourself), and change it anywhere else you used the same password.
4. If you entered card details: call your bank using the number on the back of your card and ask them to block it.
5. If you shared a one-time code: sign in to that account right away, change the password and sign out all other sessions.
6. Turn on two-factor authentication for your email, bank and shopping accounts if you have not already.

Report it, it helps everyone

Use the "Report phishing" or "Report spam" option in your email app. In Gmail it is in the three-dot menu, and in Outlook under "Report". This trains the filters that protect millions of other people. Many companies also have their own address for this, for example forwarding fake PayPal emails to [email protected]. In the US you can also report to the FTC at reportfraud.ftc.gov, and in the UK to [email protected].

Fewer phishing emails in the first place

You will never get phishing down to zero, but you can make your inbox a much smaller target:

• Do not hand your main email address to every website, contest and free download. The fewer places it lives, the fewer lists it ends up on.
• For one-off sign-ups, use a temporary email address. If that site is later breached or sells its list, the junk goes to an inbox that disappears on its own.
• Use a password manager. It will not autofill your password on paypa1.com, which makes it a surprisingly good phishing detector.
• Keep your phone and browser updated, because updates close the holes that malicious links try to use.

If your address has already been in a breach, have a look at what to do when your email is in a data breach, and for everyday habits, these email privacy best practices.

The ten-second habit

If you remember just one thing from this article, make it this: when an email wants you to act fast, slow down for ten seconds. Check who really sent it, hold the link to see where it goes, and if anything feels off, go to the website yourself instead of clicking. That small pause defeats the vast majority of phishing emails out there.

Stay safe, and if you have spotted a clever phishing trick that is not on this list, I would genuinely like to hear about it. You will find my contact details just below.