How to Spot a Phishing Email Before You Click

October 18, 2026 • NOFYI Editorial Team

A phishing email is a message that pretends to be from someone you trust, such as a bank, a delivery company, a coworker, or a well-known service, and tries to trick you into clicking a link, opening an attachment, or entering your details. It may look polished, use a familiar logo, and sound urgent. The goal is usually to steal a password, a payment detail, or access to an account. The good news is that most phishing messages leave clues. If you slow down and check a few things before you click, you can spot many of them.

This guide explains how to check the sender, the message, and the link, what to do with attachments, and how to report a suspicious message. It does not require any special software. It requires a habit: pause, check, and verify through a separate channel you trust.

What Phishing Looks Like in Everyday Life

Phishing is not always an obvious message full of spelling mistakes. Some phishing emails are plain and short. Others copy the layout of a real message so closely that the difference is only in the sender address or the link destination. Attackers may also send messages that appear to come from a person in your own organization, asking you to review a document or approve a payment. Those messages work because they borrow trust and urgency.

There are also variations. Spear phishing targets a specific person with details that make the message feel personal, such as a mention of a project, a meeting, or a recent order. Smishing is a similar trick sent by text message. Vishing is a phone call version. This guide focuses on email, but the same principle applies everywhere: do not trust a message just because it looks familiar, and do not act on a request for sensitive details that arrives out of the blue.

It helps to remember that legitimate organizations rarely ask you to sign in through a link in an unexpected email, to download an unexpected file, or to share a password or a one-time code. If a message asks for any of those things, treat it as suspicious until you have verified it another way.

How to Check a Message Step by Step

Start with the sender. Look at the full sender address, not just the display name. A display name can say almost anything, while the address behind it tells you where the message really came from. Tap or click the sender name in your email app to reveal the full address. Check the domain, which is the part after the at sign. A message that claims to be from a bank but comes from a free email service, a misspelled domain, or a domain that has nothing to do with the organization is a strong warning sign.

Next, read the message slowly. Phishing emails often use urgency to push you to act without thinking. Phrases about an account being closed, a payment failing, a package being held, or a document needing immediate review are common. Urgency is not proof of fraud on its own, because real messages can also be urgent, but urgency plus a request to click or download should make you pause.

Look for mismatches. Does the message greet you by name, or with a generic greeting? Does it refer to an order or an account you do not have? Does the tone match how that organization usually writes to you? Does it ask you to do something you would not normally do in email, such as confirm a password or install software? Any mismatch is a reason to stop and verify.

Check the link without clicking it. On a computer, hover the mouse pointer over the link and look at the address that appears near the bottom of the browser or email window. On a phone, press and hold the link to preview the destination, if your email app offers that, without tapping through. Compare the destination with the address you would expect. Watch for look-alike domains, extra words, hyphens, or a long address that hides the real domain at the end. If the link does not match the organization, do not click it.

Check attachments the same way. Do not open an unexpected attachment, even if it looks like a receipt, an invoice, or a scanned document. An attachment can carry malware, which is software designed to harm your device or steal information. If you were not expecting a file, do not open it. If you were expecting a file from a specific person, confirm with that person through a separate message or call before you open it.

Finally, verify through a separate channel. If a message claims there is a problem with your account, go to the official website by typing its address yourself, or open the official app you already use, and check for any alert there. If a message claims to be from a coworker, contact that person on a known number or through a separate message. Do not reply to the suspicious message, and do not use a phone number or link inside it to verify it.

Worked Example: A Suspicious Delivery Message

Imagine a person named Alex who is waiting for a parcel. One morning, Alex receives an email with the subject line: Action Required: Your Delivery Is On Hold. The sender display name looks like a delivery company, and the message says that a small fee must be paid within a few hours or the parcel will be returned. There is a large button that says Track and Pay, and a link that says View Delivery Details.

Alex pauses instead of clicking. First, Alex checks the sender. Tapping the sender name reveals an address from a domain that does not match the delivery company, and the domain uses a different spelling. That is the first clue.

Next, Alex reads the message. It does not include a tracking number, an order number, or the delivery address. It uses a generic greeting, and it says the parcel will be returned in a few hours if Alex does not pay. Alex was not expecting to pay a fee for this delivery, and the urgency feels designed to rush a decision. That is the second clue.

Then, Alex checks the link without clicking it. Hovering over the button shows a long address that does not belong to the delivery company, and the real domain in the address is unrelated to deliveries. Alex does not click it.

Alex verifies through a separate channel. Alex opens the delivery company app that was already installed, enters the tracking number from the original order confirmation, and sees that the parcel is on its normal route with no fee due. Alex also checks the order confirmation email from the shop, which came from a different address and includes the correct tracking number. The suspicious message does not match either source.

Finally, Alex reports the message. In the email app, Alex uses the Report Phishing or Report Junk option, if available, and then deletes the message. Alex does not reply, does not click the link, and does not download any attachment. The whole check took a few minutes, and it avoided a fake payment page.

What to Do If You Already Clicked or Entered Details

If you clicked a suspicious link, do not panic, but act promptly. Close the page. If you entered a password, change that password on the real site by typing its address yourself or opening its official app. If you used the same password elsewhere, change it on those accounts too, and make each one unique. Turn on two-factor authentication where it is available, because it adds a second check even if a password is exposed.

If you entered payment details, contact your bank or card provider using the number on the back of your card or on their official website, and tell them what happened. They can advise you on monitoring the account and replacing the card if needed. If you downloaded a file, do not open it again. Run a scan with the security software on your device, if you have it, and keep the device updated.

If the message pretended to be from your workplace, tell your IT team or manager, even if you are embarrassed. Reporting quickly helps protect other people, because the same message may have been sent to colleagues. A quick report is more useful than a perfect report.

How to Report a Phishing Email

Reporting helps email providers and organizations block similar messages. Most email apps have a Report Phishing, Report Junk, or Report Spam option in the message menu. Use it instead of simply deleting the message, when you can. Some organizations also have a dedicated address for reporting phishing, which you can find on their official support pages. Forward the message to that address only if you are sure you found it on the official site, and do not forward it to friends or colleagues as a warning, because that spreads the link.

If the message impersonates a company, you can also report it through that company official support channel. Give them the sender address, the subject line, and the link destination if you safely previewed it, but do not click the link to gather details. If you are in a workplace, follow your organization reporting process, which may be a button in your email app or a message to a security team.

Limitations

These checks catch many phishing messages, but they do not catch all of them. Some phishing emails come from compromised accounts, so the sender address looks correct. Some use a real-looking domain that was registered for the attack. Some are written carefully, with no spelling errors and no obvious urgency. That is why verification through a separate channel matters more than any single clue.

Email filters and security software also help, but they are not perfect. A message that reaches your inbox is not automatically safe, and a message that lands in spam is not automatically harmful. Treat every unexpected request for sensitive details as a question to verify, not as an instruction to follow.

Finally, checking a link by hovering is useful, but it is not a guarantee. Attackers can hide a destination behind a button, a shortened link, or a redirect. If you are unsure, do not click at all. Go to the site yourself, or use a bookmark or an app you already trust.

Frequently Asked Questions

What if the email looks exactly like a real one?

Pause and verify through a separate channel. Open the official app or type the official address yourself, and check for the same alert there. If the real account shows no problem, treat the email as suspicious, even if the layout looks perfect.

Should I reply to ask if a message is real?

No. Do not reply to a suspicious message. A reply confirms that your address is active, and the reply may go to the attacker. Contact the organization through a channel you already trust, such as its official app or a number you have used before.

Is it safe to unsubscribe from a suspicious email?

No. Do not click an unsubscribe link in a message you do not trust. That link may be a phishing link, or it may confirm your address. If you do not recognize the sender, report the message and delete it instead.

What if I only clicked, but did not enter anything?

Close the page and do not enter any details. If you downloaded a file, do not open it, and run a security scan if you have one. If you are worried the site tried to install something, update your device and browser, and consider changing the password for any account that was mentioned in the message.

Spotting phishing is a habit, not a single trick. Check the sender, slow down when a message feels urgent, hover over links without clicking, do not open unexpected attachments, and verify through a separate channel. Report the message, then delete it. That simple routine protects you far more than trying to judge a message by how professional it looks.