← All guides

How to Spot a Phishing Email (Before Someone Clicks)

Updated October 12, 2026 · 7 min read

  • Email
  • Security
  • Phishing

How to Spot a Phishing Email (Before Someone Clicks)

What you will need: Your email (on a computer or phone) and about 2 minutes per suspicious message.

Phishing (pronounced "fishing") is an email, text, or message designed to trick you into clicking a bad link, opening a bad file, sharing a password, or sending money. Nobody needs to feel silly about falling for one. They're built to look normal. This guide gives you a short routine to catch them.

The 2-minute check

Pause before you click, reply, or open anything, and run through these six checks:

  1. Does it feel urgent or scary?
  2. Does the sender's real address match who they claim to be?
  3. Where does the link actually go?
  4. Were you expecting this attachment?
  5. Is it an invoice or a "payment details changed" message?
  6. Is anyone asking for gift cards?

One "yes" doesn't prove it's fake, but it's a good reason to slow down and verify.

Step 1: Notice urgent or scary language

Scammers want you to react before you think. Watch for:

  • "Your account will be closed in 24 hours"
  • "Immediate action required"
  • "Suspicious activity detected"
  • "Payment overdue, final notice"
  • A message from your "boss" or "owner" saying they need something done right now and can't talk

What to do: If a message is pushing you to hurry, that's your cue to slow down. Contact the sender a different way (call a number you already have, not one in the email) and ask if it's real.

Step 2: Check the sender's real address

The name you see ("Jane at Your Bank") can be set to anything. The actual email address underneath is the part to check.

Look for:

  • Misspellings or swapped characters, such as paypa1.com (a number 1 instead of an "l")
  • A well-known company name paired with an odd address, such as billing@random-name123.com
  • A domain (the part after the @ sign) that doesn't match the company's real website
  • A "reply-to" address that differs from the sender

On a computer:

  1. Open the email.
  2. Show the full address:
    • In Gmail: click the down arrow below the sender's name.
    • In Outlook: click the sender's name or picture, or open the message details.
  3. Read the part after the @ sign, letter by letter.

On a phone:

  1. Open the email.
  2. Tap the sender's name at the top of the message. Many email apps will show the full address. If yours doesn't, look for a small arrow or a "details" option.
  3. Check the domain the same way.

Phone screens often show only the sender's name, which makes fakes easier to miss. If you're unsure, look again on a computer.

A link's visible text can say one thing while the link goes somewhere else.

On a computer:

  1. Don't click.
  2. Hover your mouse over the link.
  3. Look at the web address that appears, usually in the bottom corner of the window.
  4. Ask: does this match the company the email claims to be from?

On a phone:

  1. Don't tap.
  2. Long-press the link (press and hold your finger on it) to see where it goes, if your app supports it.
  3. Read the address shown.
  4. If no preview appears, don't tap the link. Use the safer habit below instead.

Red flags: Strange spelling, long strings of random characters, or a web address that starts with the real company name but ends somewhere else (for example, yourbank.com.something-else.net, where the real domain is something-else.net).

Safer habit: Skip the link. Open a new browser window, type the company's website yourself, and log in there.

Step 4: Be careful with unexpected attachments

An attachment is a file that travels with an email, such as a PDF, Word document, or zip file.

Be extra cautious if:

  • You weren't expecting a file from this person
  • The message is vague ("See attached," "Review document")
  • The file asks you to "enable macros" or "enable editing" to view it
  • The file type is unusual, such as .zip or .exe

What to do: Don't open it. Check with the sender by phone or in person. A real colleague won't mind the question.

Step 5: Question fake invoices and "payment details changed" requests

Small offices get targeted with these because they involve real money.

Common versions:

  • An invoice from a company you don't recognize
  • A real vendor saying "our bank details have changed, please use the new account"
  • A message that looks like it's from your own boss asking you to pay someone quickly

What to do:

  1. Don't pay based on the email alone.
  2. Call the vendor using a phone number you already have on file, not one from the email.
  3. Confirm any change to bank or payment details before sending money.
  4. Set a simple office rule that any change to payment details requires a phone confirmation, and let everyone know they're allowed to say "I need to double-check this."

Step 6: Treat gift card requests as a red flag

Real businesses and real bosses almost never ask staff to buy gift cards and send the codes.

If you get this request:

  1. Don't buy anything.
  2. Don't reply with codes.
  3. Contact the person by phone or in person to confirm.

What to do if someone already clicked

It happens. Acting quickly helps, and nobody should be shamed for reporting it.

  1. Tell someone and call IT right away. Let the owner or office manager know, even if you're not sure anything happened. Then contact whoever handles your IT and tell them what was clicked, when, and what was entered, if anything.
  2. Ask IT whether to disconnect. Disconnecting means turning off Wi-Fi or unplugging the network cable on that computer or phone. This can help stop anything bad from spreading or sending information out, but whether it's the right move can depend on your setup, so have IT confirm before or as you do it. If you can't reach anyone right away, ask the owner or office manager what to do.
  3. Don't enter more information. If a page asks for a password, close it.
  4. Update your security software and run a scan. Security software (also called antivirus) is a program that looks for harmful files on a device. Make sure it's up to date, then run a full scan on the device that was used. Updating usually needs an internet connection, so ask IT whether to do this before or after reconnecting.
  5. Change the password. If the person typed a password into a suspicious page, change it right away on the real website. Use a different, trusted device if possible, and type the website address yourself. If that password is used anywhere else, change it there too.
  6. If money was sent, call your bank right away, tell them what happened, and ask what they recommend.

Optional but helpful: Turn on multi-factor authentication (also called MFA or two-step login). This asks for a second proof of identity, like a code sent to your phone, so a stolen password alone isn't enough to get in.

Further reading: The U.S. Federal Trade Commission has a plain-language guide at https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams

Quick reminder

  • Slow down when a message feels rushed.
  • Check the real sender address.
  • Preview links before clicking.
  • Verify money requests by phone.
  • Report mistakes right away.

If an email looks off and you're not sure, ask someone before you click.

Related guides