How to Spot a Phishing Email When It Looks Perfect

It sits in your inbox, a message from your bank, from a delivery service or from Microsoft, and something about it feels slightly off. Maybe the deadline is tonight. Maybe you were not expecting anything at all. Learning how to spot phishing email comes down to one habit at that moment: do not click until you have checked a couple of things that cannot be faked, or whose forgery leaves a trace. It takes less than a minute.

The rest of this piece explains which things those are, and why the old rule about bad grammar has quietly stopped working. It also covers what to do if you already clicked, and where to send the message so that it does less damage to the next person.

How to spot phishing email: check first, click later

A phishing email wants you to do something. Usually that means clicking a link and typing a password, a one-time code or card details into the page behind it. Sometimes it means opening an attachment or wiring money. Everything else in the message, the logo, the tone, the tidy footer with a street address, exists to serve that single goal.

That leads to the most useful rule of all. You do not have to judge the writing. You only have to check where the requested action leads. An email can be written in flawless English and still be forged. The link inside it has to point somewhere, and that destination belongs to the criminals.

The real sender address behind the name

What your mail app shows in bold as the sender is usually just a display name. Anyone can type “Chase Fraud Alert” or “Amazon Support” into that field. It costs nothing. No server checks it. The actual address sits behind the name, often only visible after you click or tap on it.

There you may find something like [email protected]. Or an address at a free webmail provider. Neither belongs to the bank. Why well-forged addresses still make it through, and what SPF, DKIM and DMARC have to do with it, is covered in our piece on spoofing. For the quick check, one question is enough: does the address end in exactly the domain you know from that company?

Where the link really goes

This is the strongest check you have. On a computer, rest the mouse pointer on the link or button without clicking. The destination appears at the bottom of the window or in a small tooltip. On a phone, press and hold the link until a menu shows the address, then tap outside it.

Read the address from the right, up to the first single slash. What matters is the part just before the ending. In https://login.paypal.com.account-review.net/ the real domain is account-review.net, and everything to the left of it is decoration that can say anything at all. Lookalike spellings work the same way: a capital I in place of a lowercase l, or rn squeezed together to pass for an m.

Shortened links from services like bit.ly hide the destination entirely. That alone is a warning. A real bank almost never sends one in a security alert. If you meet one, treat the message as unverified and go to the site on your own.

Pressure, deadlines and threats

Nearly every phishing email puts you on a clock. Your account will be locked, your package returned, your subscription canceled, and soon. The pressure has a purpose. People in a hurry skip the checks.

The script varies with the season. Around tax time the message comes from the IRS, before the holidays it is a delivery that could not be completed, and in between it is a streaming service whose payment supposedly failed. The IRS itself says it does not start contact with taxpayers by email to ask for personal or financial information. When a threat arrives by email with a button attached, the button is the tell.

Attachments and forms

Invoices as ZIP files, Office documents asking you to “enable content”, HTML files that open in the browser as a login page: these are classic ways to slip malware or a credential form past filters. An unexpected message with an attachment deserves suspicion even when the sender looks familiar. Banks do not email you forms in which you are meant to enter your login.

One variant drops the link altogether and puts a QR code into the message or the attached PDF. You scan it with your phone, and the page lands on a small screen where the address is harder to read. That trick has its own name, quishing, and it works on parking meters as well as in email.

The greeting is a weak signal

“Dear Customer” instead of your name looks suspicious, and often it is. The signal cuts both ways, though. Plenty of genuine newsletters skip the personal greeting. And scammers often know your name already, because it came bundled with your email address from some breach that ended up online.

A correct greeting with your full name is no proof of anything. It only shows that someone has your data.

Why typos no longer give phishing away

For years the first tip was to watch for broken English. It dates from a time when phishing emails were machine-translated and clumsy, with odd word order and misplaced capitals. Those messages still exist. But anyone who relies on spotting mistakes gets a false sense of safety the moment there are none.

The clearest evidence comes from a study by Fred Heiding, Bruce Schneier and Arun Vishwanath, published at the end of November 2024. The researchers sent different phishing emails to 101 participants. Generic mass phishing got a click rate of 12 percent. Emails written entirely by a language model, which had also researched each person on its own, reached 54 percent. That was exactly the rate achieved by emails that human experts had crafted by hand.

The sample is small, the message is not. Software now writes as convincingly as a professional, error-free and tailored to the reader, for a fraction of the cost. Checking the grammar tells you less every year. Checking the destination still tells you everything.

How much each warning sign is worth

Not every red flag carries the same weight. Some settle the question almost on their own, others are hints that only mean something together.

If you are still unsure after these checks, take another route. Close the email and open the company’s app or website yourself, through a bookmark or an address you type. If something really is wrong with your account, it will show up there. For anything involving money, call the company on a number that did not come from the message.

When the target is a payment, not a password

Phishing aimed at consumers usually wants login details. Inside companies there is a variant that often needs no link at all and brings in far more money. It is called business email compromise. Someone poses by email as a boss, a supplier or a partner and asks for a wire transfer, usually urgent and confidential.

The best-known case hit two of the largest technology companies in the world. Between 2013 and 2015, a Lithuanian man named Evaldas Rimasauskas registered domains that imitated Quanta, a Taiwanese manufacturer that really did build hardware for Facebook and Google. He then sent fake invoices, and employees at both companies paid them. Facebook lost about 99 million dollars, Google about 23 million. Rimasauskas pleaded guilty in Manhattan and in December 2019 was sentenced to five years in federal prison. Nobody broke into a server. A believable supplier and a believable invoice were enough. The money was simply sent.

How big the problem is overall shows up in the FBI’s latest annual report from the Internet Crime Complaint Center. For 2025 the IC3 counted 24,768 business email compromise complaints with reported losses of about 3.05 billion dollars. Only investment fraud caused more damage. Phishing and spoofing, counted together, drew 191,561 complaints, more than any other category in the report. Across all categories, Americans filed more than a million complaints and reported losses of nearly 21 billion dollars.

The defense is boring. It works. Any payment request that arrives by email gets confirmed through a second channel, with a phone call to a number you already had. And a supplier’s changed bank details are not valid until someone has called that supplier.

Even professionals get it wrong

The most famous phishing case of all shows how fast a judgment can tip. On March 19, 2016, John Podesta, chairman of Hillary Clinton’s presidential campaign, received an email at his personal Gmail account. It seemed to come from Google, from the address [email protected]. Someone in Ukraine had used his password, it said, and he should change it immediately. The button led through a bit.ly short link.

The message did make people suspicious, and they did the sensible thing. His chief of staff passed it to the campaign’s IT help. The reply came back that the email was “legitimate”, that he should change his password and turn on two-step verification. The reply even included the real Google link. Apparently the link from the phishing email got used anyway.

The staffer later told the New York Times he had meant to type “illegitimate”. Two missing letters, and from October 2016 WikiLeaks published more than 20,000 pages from the account. The lesson has less to do with Podesta than with the procedure. If you never use the link inside a suspicious password email and always go to the site yourself, a misunderstanding like that cannot hurt you.

You already clicked: what to do now

Take a breath first. A click alone usually does no damage. What matters is what happened after it.

If you only opened the page and typed nothing, close it, and that is usually all. Current browsers and operating systems are well protected against merely loading a page, as long as you did not download and open a file.

If a password went in, change it right away. Do it through the real app or an address you type yourself, never through a link. If you use the same password anywhere else, change it there too, because criminals test stolen logins against other services automatically. Then turn on two-factor sign-in where it is not active yet. Better still, use a passkey wherever the service offers one: it cannot be typed into a fake page at all. Then check your email account. Forwarding rules and filters you never created are a typical sign that someone got in.

If you gave away card details or a banking code, call your bank on the number printed on the back of your card, and ask it to block the card and watch the account. Keep an eye on your statements for the next few weeks. If your Social Security number or other identity details went out as well, IdentityTheft.gov from the FTC builds a recovery plan step by step, and a credit freeze at the three bureaus costs nothing.

After opening a suspicious attachment, take the device offline and check it thoroughly before you type passwords on it again. What actually counts as evidence that a device is compromised is covered in Am I Hacked?.

Where to report a phishing email

A phishing email you simply delete lands with the next person tomorrow. Reporting it helps shut the campaign down faster, and it costs you one forward.

The FTC recommends forwarding phishing emails to the Anti-Phishing Working Group at [email protected], a coalition of companies, researchers and law enforcement that collects them to track and take down campaigns. The attempt itself goes to the FTC at ReportFraud.ftc.gov. If you lost money, file a complaint at ic3.gov as well. Those complaints are what the FBI’s annual figures are built from.

Forward the message to the company whose name was abused, too. Many banks, shipping services and retailers have a dedicated address for it, usually on the security or contact page of their website. That way the company learns that someone is fishing under its name right now.

Most mail apps also have a button to report a message as phishing or spam. Using it trains your provider’s filters and protects other customers of the same service. Scam texts follow a slightly different route: you forward them to 7726, as described in our piece on smishing. On resale platforms the fake link often comes from a so-called buyer. Our piece on Facebook Marketplace scams shows how that trick works.

What is left

The phishing email is still here. It has simply learned to write. What a message looks like tells you less and less. What remains are the traces that are hard to fake: the domain behind the link, the address behind the name, and whether the problem also shows up in the real app.

The whole check takes less time than reading this paragraph. Once it becomes a habit, you no longer need a list of twenty warning signs.

Frequently asked questions

What is the most reliable way to spot a phishing email?

Two checks beat everything else, and neither involves reading the text. Look at the full sender address behind the display name, and look at where each link really goes before you click it. On a computer, hovering the mouse over a link shows its destination at the bottom of the window. On a phone, a long press does the same. If the link leads to a domain that does not belong exactly to the company that supposedly wrote to you, the question is settled. Logos, wording and a polite greeting are easy to fake.

I clicked a link in a phishing email. What should I do now?

If you only opened the page and typed nothing, close it, and in most cases that is the end of it. If you entered a password, change it right away through the real app or a web address you type yourself, change it anywhere else you reused it, and turn on two-factor sign-in. If you gave away card or bank details, call the number on the back of your card. If money is gone or your identity is at risk, the FTC walks you through the next steps at IdentityTheft.gov.

Where do I report a phishing email in the US?

The FTC asks people to forward phishing emails to the Anti-Phishing Working Group at [email protected] and to report the attempt at ReportFraud.ftc.gov. If you lost money, add a complaint at ic3.gov, the FBI site that collects internet crime reports. It also helps to forward the message to the company whose name was abused and to hit the report phishing button in your mail app.

Are spelling mistakes still a sign of phishing?

A message full of mistakes is still suspicious. But clean English proves nothing anymore. Language models write smooth, polite text in any language, and in a 2024 study people clicked fully automated AI phishing emails just as often as emails crafted by human experts. Hunting for typos means hunting for the phishing of ten years ago.

Can simply opening a phishing email infect my device?

Opening and reading a message is generally harmless in current mail apps. The danger starts with clicking a link, opening an attachment or typing anything into a form. Opening can reveal one thing, though: remote images can tell the sender that your address is active. Many mail apps only load external content when you ask, and it is worth leaving that setting on.