How to spot a phishing email before you click

Phishing is the most common way criminals try to get into your accounts. In 2025, the FBI received 191,561 complaints about phishing and spoofing, more than any other type of cybercrime (FBI Internet Crime Report 2025).

Phishing emails pretend to be from someone you trust (your bank, a delivery company, Microsoft, your boss) to get you to click a link, open an attachment, log in, or send money. Here's how to spot them.

The warning signs that still work

Scammers now use AI to write clean, professional emails, so typos are no longer a reliable clue. Focus on these instead:

• Urgency or fear. "Your account will be closed in 24 hours." "Unusual sign-in detected." "Final notice." Pressure is designed to make you act before you think.
• A request to log in, pay, or "verify." Legitimate companies rarely ask you to confirm passwords or payment details by email.
• A sender address that doesn't match. The name says "Wells Fargo," but the address is something like alerts@wellsfargo-secure-help.com. Look at the full address, not just the display name.
• Links that go somewhere else. On a computer, rest your mouse over a link (don't click) and check the address that appears. On a phone, press and hold the link to preview it.
• Unexpected attachments. An invoice you didn't order, a "shared document," or a shipping label for a package you aren't expecting.
• Payment by gift card, wire, or crypto. This is almost always a scam.

What to do with a suspicious email

1. Don't click, reply, or open attachments.
2. Check it a different way. Open your browser and type the company's website yourself, or call them on a number from your statement or card, not the one in the email.
3. Report it. Use the "Report phishing" or "Report junk" option in Gmail, Outlook, or Apple Mail. The FTC also recommends forwarding phishing emails to reportphishing@apwg.org (FTC phishing guidance).
4. Delete it.

What if you already clicked?

Don't panic, but act quickly. If you entered a password, change it right away from a different device, starting with your email account, and turn on multi-factor authentication. If you entered card or bank details, call your bank. Our post "I got hacked: the first 5 things you should do right now" walks through every step.

Sources: FBI Internet Crime Report 2025 · FTC: How to recognize and avoid phishing scams