How to Spot a Phishing Email Before It Is Too Late

Phishing emails have become far more convincing in recent years. Attackers now use real company branding, personalised details, and professional language. Knowing what to look for is one of the most practical security skills you can develop.

Check the Sender Address Carefully

The display name in an email can say anything. What matters is the actual email address. A message appearing to come from your bank might have a sender address like support@securebank-alerts.net instead of the legitimate domain. Look at the full address, not just the name shown.

Attackers also use subtle misspellings: paypa1.com instead of paypal.com, or rn at the start of a word to mimic m. These are easy to miss when you are reading quickly.

Inspect Links Before You Click

Hover over any link in an email before clicking it. The actual URL will appear in the bottom of your browser. If the destination address does not match the organisation the email claims to be from, do not click it.

Shortened URLs (like bit.ly links) are a common way to disguise a malicious destination. Treat them with extra caution, especially in unsolicited emails.

Watch for Pressure and Urgency

Phishing emails almost always create a sense of urgency. Your account will be closed, a payment failed, your order has been flagged. This pressure is intentional: it is designed to make you act before you think. Legitimate organisations do not demand immediate action under threat of serious consequences.

Attachments and Requests for Information

Never open an attachment from an email you were not expecting, even if the sender appears to be someone you know. Accounts get compromised and attackers send malicious files from real addresses.

Legitimate organisations will never ask for your password, full card number, or one-time code via email. If an email asks for any of these, it is a phishing attempt regardless of how official it looks.

If You Are Unsure

Go directly to the official website by typing the address into your browser rather than clicking any link in the email. Contact the organisation through a number or address you find on their official site, not from the email itself. A few extra seconds of verification is always worth it.