How to Spot a Phishing Email: 7 Checks Before You Click

This article was originally published on Nexvolu: How to Spot a Phishing Email: 7 Checks Before You Click

A phishing email pretends to be from a bank, a delivery company or a service you use, so you click a link, enter a password or share a code. These 7 checks catch most of them in under a minute, before you click.

How do you spot a phishing email? Check the sender's real domain, hover over the link to read its real destination, and test what the message is asking you to do. If any one of those three checks fails, do not click. Go to the service directly instead.

A phishing email is a message that pretends to come from someone you trust, such as your bank, a delivery company, Microsoft, Google, or a colleague, so you click a link, open an attachment, type a password or one-time code, or send money. The message itself is rarely the attack. The link, the attachment, or the fake sign-in page it leads to is.

Spelling mistakes used to give phishing away. Modern phishing emails, many of them written with AI tools, have clean grammar, your real name, a convincing logo, and a sender address that looks right at a glance. The UK's National Cyber Security Centre now warns that scams are getting smarter and some even fool the experts.

The 7 checks at a glance

1. Sender domain: read the real address behind the display name. Stop if the domain is not the organisation's real domain.
2. Link destination: check where the link actually goes before you click. Stop if the link text and destination do not match.
3. The request: check what the message wants you to do. Stop if it asks for a password, a code, a payment, or an MFA approval.
4. Urgency: watch for deadline and threat language. Stop if you see "Suspended in 24 hours" plus a link.
5. Attachments and QR codes: beware files and codes you did not expect. Stop if there is an unexpected file, invoice, or QR code to scan.
6. Greeting and reply-to: check how it addresses you and where replies go. Stop if there is a generic greeting or a reply-to on another domain.
7. Verify another way: use the service, not the message. Stop if you cannot confirm it on the official app or site.

1. Read the sender's domain, not the display name

The display name is free to set and means nothing. A message can show "Microsoft Support" or "Your Bank" while the real address behind it belongs to someone else entirely.

Tap or click the sender's name to expand the real address, then ignore everything before the @ and read the domain, the part after the @. That is the only part of the sender line that costs an attacker real effort to fake well.

Read the domain from the right, not the left. In billing.paypal.com, the owner is PayPal. In billing.paypal-secure-alerts.com, the owner is paypal-secure-alerts.com, a different domain that only sounds like PayPal. Watch for the same trick with lookalike spellings: paypa1.com with a digit 1, micros0ft.com with a zero, or an extra word such as account-apple.com.

One honest limit: a message can pass email authentication checks (SPF, DKIM and DMARC) and still be a scam. Those checks prove the message genuinely came from the domain in the sender line. They say nothing about whether that domain is honest, and they do not stop visually similar "cousin domains" or abuse of the display name.

If the sender domain is not the organisation's real domain, the message is not from that organisation, no matter how official the logo looks.

2. Read the link's real destination before you click

Link text is a promise. The destination is the truth. The visible text can say https://www.microsoft.com while the actual destination is something else entirely. That mismatch is the signal.

On a computer, hover over the link and read the URL in the status bar, without clicking. On a phone, press and hold the link until the full destination appears. Then read the domain the same way you read the sender: from the right. Find the first slash after the protocol and read the hostname from its right-hand end. In microsoft.com.login-secure.ru, the real domain is login-secure.ru, not Microsoft.

Be suspicious of these in particular:

• URL shorteners that hide the destination, such as a Bitly link in a password-reset message.
• Raw IP addresses in place of a hostname, such as a link starting with numbers instead of a domain name.
• Subdomains designed to mislead, such as yourbank.com.verify-now.net, where the registered domain is verify-now.net.
• Buttons that do not show a destination on hover, or a link whose text and destination differ in any way.

If you cannot see where a link goes, treat it as untrusted. A genuine password reset or delivery notice can wait the thirty seconds it takes to open the official app instead.

3. Test the request itself

The request test is the heart of how to spot a phishing email, because it does not depend on spotting a fake logo or a misspelt domain. Ask one question: what does this message want me to do?

• If it asks for your password, or to sign in through its link: do not enter it. Go to the site or app directly and sign in there.
• If it asks for a one-time code or authenticator approval: do not share it or approve it. A real service will not ask for your code by email.
• If it asks for a payment, or changed bank details: do not pay from the link. Confirm the change by phone on a number you already have.
• If it asks you to download a file or install software: do not open it. Get software only from the official site or app store.
• If it asks you to scan a QR code to sign in or pay: do not scan it. QR codes hide the destination in the same way short links do.

Real banks, government departments and large services do not ask you to unlock an account, verify a payment or confirm an identity through a link in an email. Google's own guidance is direct on this point: do not enter your password after clicking a link in a message. If you are signed in and an email from Google asks for your Google Account password, do not enter it. Go directly to the website you want to use instead.

4. Watch for urgency plus a threat

Urgency on its own is not proof of phishing. A real delivery notice can be urgent too. The pattern to watch is urgency combined with a link, a code, a file, or a payment.

Common versions include "Your account will be suspended in 24 hours", "Unusual sign-in. Verify now or lose access", "Your package could not be delivered. Pay the fee today", and "Your invoice is overdue. Download the attachment". The deadline is there to stop you checking.

The Verizon 2026 Data Breach Investigations Report found that the fastest phishing victims click in a median of 21 seconds after opening the email. Speed, not carelessness, is what the deadline is designed to exploit.

The counter-move is simple and does not require judgement: slow down on any message that wants money, credentials, or an MFA approval. If the threat is real, it will still be real after you check it on the official app or by calling the organisation on a number you already have. If it is fake, those thirty seconds are what saves you.

5. Do not open unexpected attachments

An unexpected invoice, receipt, shipping label, "voice message" or document, especially one with a password, a .zip file, or a macro-enabled Office file is a common phishing delivery method. The attachment itself may be the attack, even if the email text looks harmless.

QR codes deserve the same caution. QR phishing, sometimes called quishing, rose sharply as attackers realised that a code printed in an email hides its destination from both the reader and many email filters. A QR code in an unexpected message asking you to sign in, verify a payment or claim a parcel should be treated exactly like a shortened link you cannot read.

Ask the same question as before: were you expecting this file or code, from this sender, at this time? If the answer is no, do not open it. Contact the supposed sender through a channel you already trust and ask whether they sent it.

6. Check the greeting and the reply-to address

These two checks are weaker than the ones above. A real bulk email can also start with "Dear Customer", and a real company can use a different reply-to domain. Use them as supporting evidence, not as proof on their own.

A generic greeting ("Dear Customer", "Dear User") in a message that claims to know your account is a small warning sign. So is a message that uses your full name and details correctly. That no longer proves it is genuine, because those details are often taken from a data breach or from your public profiles.

The reply-to field is more useful. Tap the sender details and check where a reply would go. An invoice that arrives from a supplier's genuine domain but asks you to reply to a mailbox on a different domain is announcing the fraud in its own metadata.

7. Verify through another channel, never through the message

If you are still unsure after the first six checks, this check settles it. Do not use the link, phone number, or reply address in the suspicious message. Use a channel you already trust:

• Open the official app, or type the organisation's address into your browser yourself.
• For a bank or delivery, check the account or tracking page inside the app.
• For a security alert, check the account's own security or notifications page. For Google, that is myaccount.google.com/notifications.
• For a payment change, call the organisation on a number from its official site or the back of your card.

If the message is genuine, you will see the same alert, parcel, invoice or sign-in inside the official account. If you see nothing there, the message was fake, and you found out without clicking anything.

Phishing or legitimate? A quick comparison

• Sender domain: usually legitimate means the organisation's real domain; often phishing means a lookalike, extra words, or a different domain.
• Link destination: usually legitimate means it matches the link text and the real domain; often phishing means hidden, shortened, or a different domain.
• What it asks for: usually legitimate means to check something in your account; often phishing means password, code, payment, or download now.
• Tone: usually legitimate means neutral, no deadline threat; often phishing means urgent threat plus a link.
• Attachment: usually legitimate means one you were expecting; often phishing means unexpected file, zip, or QR code.
• Verification: usually legitimate means the same alert is visible in the official app; often phishing means nothing matching in the official app.

No single row proves a message is safe or fake. Two or more rows on the phishing side are enough to stop and verify another way.

What to do if you already clicked a phishing link

Do not panic, and do not try to fix it by clicking more links in the same message. Work through these steps in order:

1. Stop the damage first. If a file downloaded, do not open it. If you think it may have run, disconnect from the internet and run a full scan with your security software.
2. Change the password from the official site, not the link. Open the service directly, change the password to a strong, unique one, and do the same for any other account that reused that password.
3. Revoke sessions and check recent activity. In the account's security settings, sign out of all sessions and review recent sign-ins, connected apps and recovery options for anything you do not recognise.
4. Turn on 2-Step Verification if it is not already on. It does not undo a stolen password on its own, but it makes the stolen password much less useful.
5. If money or card details were involved, act immediately. Contact your bank or card provider, report the transaction, and ask them to watch or replace the card. Keep the phishing email as evidence until you have reported it.
6. Report the message. In Gmail, open the message, click More (the three dots next to Reply) and choose Report phishing. In Outlook, use Report, then Report phishing. Reporting helps Google and Microsoft block the same message for other people.

How to report a phishing email

• Gmail (computer): open the message, click More next to Reply, then click Report phishing.
• Gmail (phone): open the message, tap the three-dot menu, then tap Report phishing.
• Outlook: open the message, choose Report, then Report phishing.
• Apple Mail: move the message to Junk. Apple uses Junk reports to improve its filters.

Do not reply to, forward, or click anything in the message before you report it. Reporting first, and clicking never, is the rule.

Why phishing is still growing in 2026

The Anti-Phishing Working Group recorded about 3.8 million phishing attacks in 2025, up slightly from 3.76 million in 2024. The FBI's Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024, the largest count for any crime category it tracks. The Verizon 2026 Data Breach Investigations Report attributes 62% of breaches to the human element, and phishing was the initial access in 16% of them.

AI tools have made well-written, personalised phishing cheap to produce at scale, and the same urgency trick now appears in SMS, QR codes, voice calls and social messages, not only in email. That is why this guide focuses on the destination and the request, not on spelling or logos. The wrapper changes, the destination test does not.

Frequently asked questions

Can a phishing email look exactly like a real one?

Yes. Attackers copy real brand templates, use your real name, and register lookalike domains. Clean grammar and a convincing logo no longer prove a message is genuine. Check the sender domain, the link destination, and what the message asks you to do.

Is it safe to open a phishing email to check it?

Opening the message to read it is generally low risk in a modern mail app, because images and scripts are usually blocked. The risk starts when you click a link, open an attachment, scan a QR code, or reply with information. Read, check, report, and click nothing.

What if I only clicked the link but entered nothing?

Do not enter anything further, close the page, and clear your browser data if the page looked suspicious. Change the password for that service from the official site if you have any doubt, and watch the account's recent activity for a few days. If a file downloaded, run a full security scan.

Does 2FA protect me from phishing?

It helps a lot, but it is not a complete shield. Ordinary 2FA can still be bypassed if you type a code into a fake sign-in page or approve a prompt you did not start. Phishing-resistant methods, such as passkeys and security keys, are stronger because they do not work on a fake site. Keep your backup codes somewhere you can reach without the device or account that has failed.

Should I report a phishing email or just delete it?

Report it first, then delete it. Reporting in Gmail or Outlook sends the message to the provider's security team and helps block the same campaign for other people. Deleting it without reporting only protects you.

The safest place to check a suspicious message is not inside the message. Check the sender domain, check the link destination, and check the request. Then verify it on the official app or site, where the sender cannot follow you.

Read the full original article on Nexvolu: How to Spot a Phishing Email: 7 Checks Before You Click

Quick question for readers

Have you ever received a phishing email? Tell us in the comments what gave it away, or what you wish you had checked first.