How to spot a phishing email: signs that work
A phishing email is a message that pretends to come from someone you trust, such as your bank, a supplier, Microsoft, or a colleague, to make you click a link, open an attachment, sign in, or pay. Spelling mistakes are no longer a reliable clue. The signs that still work are pressure, a request that breaks your routine, and a sender or link that does not match the company.
How to spot a phishing email
Ignore the spelling and look at what the email wants from you. If it pushes you to act fast, asks you to sign in, pay, or share information, or changes something routine such as bank details, treat it as suspicious until you have checked it another way. That habit, more than any list of clues, is what recognizing a fake message comes down to. The NCSC’s page on how to spot scams admits it plainly: it used to be easier.
Why typos no longer give it away
The old advice, look for bad grammar and a strange email address, is less useful every year. Canada’s Cyber Centre, in its guide “Don’t take the bait”, warns that AI is making poor spelling and robotic phrasing harder to find, and that it helps scammers personalize messages to a specific person or company. Gmail’s help pages add that phishing can impersonate someone you know, including a coworker. A well-written email from a familiar name is no longer proof of anything.
The pressure signs
The NCSC lists five tell-tale signs of pressure. Most scams use at least one:
| Sign | What it sounds like |
|---|---|
| Authority | A bank, a tax agency, Microsoft, the police, or your own boss |
| Urgency | Pay today, your account will be closed in 24 hours |
| Emotion | Fear of a penalty, worry about a relative, excitement about a refund |
| Scarcity | A limited offer, a last chance, a parcel about to be returned |
| Current events | A tax deadline, a holiday sale, a news story, a data breach |
Canada’s Get Cyber Safe adds a line that is worth repeating to a whole team: real emergencies do not happen over email.
The checks that still work
- The sender’s address. Apple advises checking that the sender’s email or phone number matches the company’s name and that the message reached the address you actually gave that company. Australia’s Scamwatch warns about slight variations: an extra dot, a number, a special character.
- The link. Hover over it on a computer, or press and hold on a phone, and read the address before you tap. A link that does not match the company’s real website is the clearest sign of all.
- Authentication markers. Gmail shows whether a message was authenticated, and Outlook shows a question mark in place of the sender’s picture when it cannot verify the sender.
- The request. A login link, an attachment you did not expect, a QR code in an email, or a change of payment details are all reasons to slow down. The NCSC specifically advises caution with QR codes received by email.
- Your name. Scamwatch points out that a message from “your bank” that does not use your proper name is a warning sign.
The one rule that matters
The authorities we checked in the UK, Canada, and the US give the same advice: verify through a channel you already trust. Do not use the phone number, link, or address in the message. Open the company’s app or website yourself, call the number on your card or statement, or ask your colleague in person. Canada’s Cyber Centre suggests switching channels: if a company texts you, check by email or by phone instead.
What real companies say they never ask
Some companies spell out what they will never do, which helps settle a doubt quickly. Apple, for example, says it will never ask you to disable a security feature on your device or account. The same logic applies to your bank and your suppliers: if a message asks you to switch off a protection, read out a code, or pay a new account, the answer is no until you have checked.
If you already clicked
Do not panic, and act in order: close the page, change the password of the account concerned from the real website, and turn on a second factor if it was not already on. If you entered card or bank details, call your bank on the number you know. Then report the email.
Reporting the email
Reporting takes a few seconds and helps take scam sites down. See where to report a phishing email in each country, including the report buttons in Gmail and Outlook.
When the email comes from a real colleague’s account
The checks above fail when a scammer writes from a real, compromised mailbox. That is the territory of business email compromise and CEO fraud.