How to Recognize and Avoid a Phishing Email

By Morgan · Reviewed by CaseyLast updated August 5, 2026

A phishing email is a fake message designed to look like it’s from a real company — your bank, PayPal, Amazon, or even the IRS — that tries to trick you into clicking a link and entering your password or personal information on a fake website. The safest response is to never click the link in the email itself, and instead go directly to the company’s real website or app by typing the address yourself or using an app you already trust. The signs below help you catch these before you ever click.

Signs an email is phishing

• It creates urgency: “Your account will be suspended,” “Unusual activity detected,” or “Action required within 24 hours”
• It asks you to click a link and “verify,” “confirm,” or “update” your account information
• The sender’s email address doesn’t quite match the real company (for example, “amazon-support123@mail.ru” instead of an official amazon.com address)
• The greeting is generic, like “Dear Customer,” instead of using your actual name
• There are small spelling or grammar mistakes, or the logo and formatting look slightly off
• It asks you to open an unexpected attachment, especially a .zip file or one you weren’t expecting

Real companies rarely ask you to “verify your account” by clicking a link in an unexpected email. If you’re ever unsure, don’t click anything — log in the way you normally would, directly through the company’s app or by typing their website address yourself.

Step 1: Don’t click any links or attachments

Even if the email looks convincing, the safest first move is to leave everything in it untouched. Clicking a link can take you to a fake login page designed to steal your password, and opening an attachment can install unwanted software.

Step 2: Check the sender’s actual email address

1. Look at the sender’s full email address, not just the display name (which can be faked to say anything).
2. On most phones and computers, tapping or hovering over the sender’s name reveals the real address underneath.
3. Compare it closely to the company’s real domain — watch for extra words, misspellings, or a completely different domain after the “@” symbol.

Step 3: Check the link without clicking it

1. On a computer, hover your mouse over the link (without clicking) to see the actual web address in the bottom corner of your screen.
2. On a phone, press and hold the link briefly to preview the address before it opens.
3. If the address doesn’t match the company’s real website, it’s not legitimate.

Step 4: Verify directly through the real company instead

1. Open a new browser tab or the company’s official app.
2. Type the company’s website address yourself, or use a bookmark you’ve saved previously — never a link from the email.
3. Log in normally and check your account for any real alerts or messages, which will also appear there if something genuinely needs attention.

Step 5: Report and delete the email

1. Look for a Report phishing or Report spam option in your email app, usually under a three-dot menu next to the message.
2. Most email providers use these reports to improve filtering for everyone, not just you.
3. Delete the email once reported.

What to do if you already clicked the link

Don’t panic, but act promptly:

1. If you entered a password: change that password immediately, and change it on any other account where you reused it.
2. If you entered payment card information: contact your card issuer right away to review recent charges and consider requesting a new card number.
3. If you opened an attachment: run a scan with your device’s built-in security software (see the “Run a scan” step in our article on pop-up ads and viruses) as a precaution.

Frequently asked questions