How to spot a phishing email — 7 signs of a scam

A case we see in the shop all the time: a laptop behaving strangely — sluggish, pop-up ads — and, above all, someone has sent dozens of scam emails from the owner’s account to every one of their contacts. The trail usually leads back to a single click: a “parcel delivery link”, a “message from the bank”, an “invoice to pay”. It looked legitimate, but within seconds of the click a phishing site had pulled malware onto the machine.

We deal with cases like this every month — from students who lost access to university systems to sole traders whose business account was drained. Phishing attacks keep getting more sophisticated, but they still share a set of tells you can learn to read. Here are 7 concrete things to look for.

1. A sender you don’t know (or know all too well)

The first thing I look at: who sent it. And it’s not enough to glance at the display name. The attacker can set that to anything — “Your Bank” or “My boss Charles” if they like. What matters is the real email address.

Click on the sender’s name and look at the actual address. If “Your Bank” is writing from bank-info@quick-money24.xyz, it’s a scam. The same goes for addresses that pose as legitimate but have a typo or an odd domain — say info@yourbank-security.com instead of the official info@yourbank.com.

A classic scenario: an employee gets an email from “the boss” asking for an urgent payment or for a sensitive file to be forwarded. The address looks like boss.name@company-info.com — except the real company domain is company.com. A one-word difference you’ll miss when you’re in a hurry.

2. Urgency and pressure: “Act now!”

Phishing emails push you into a fast decision. “Your account will be suspended within 24 hours.” “Payment failed — act immediately.” “Security incident — change your password now.”

Why the rush? Because once they get you moving fast, you stop thinking. Legitimate companies don’t communicate like this. A bank will never email you saying you’ll lose all your money within the hour unless you click a link. At most they’ll send a notification inside their app.

I teach clients a simple rule: if an email is pushing you to act immediately under threat of consequences, stop for five minutes. Open the service’s website yourself in the browser (not via the link in the email) and log in. If there’s a real problem, you’ll see it there.

3. Suspicious links — hover, don’t click

This is the golden rule I repeat over and over: never click a link in an email until you know where it leads. Hover the mouse over the link (without clicking) and the real destination appears at the bottom of the browser or under the cursor.

Look at it. If the link claims to go to www.mybank.com but actually points to www.mybank.login-hack24.net, it’s a scam. Attackers often use subdomains to make the address look trustworthy.

A common example: an email “from Microsoft” about an expiring password, with a link to microsoft-verify.account-reset365.com. Looks almost right, doesn’t it? It isn’t. Microsoft only uses domains like microsoft.com or account.microsoft.com. Everything else is suspect.

4. Grammar mistakes and awkward language

In 2026 phishing emails are no longer as clumsy as they were a few years ago, but you’ll still hit odd phrasing, machine translation, or wording a native speaker would never use.

“Dear customer, Your account have been compromised. Please click here for immediate restore of security.” No native English speaker at a real bank wrote that. A translator did, or someone who doesn’t have the language.

The small slips a native speaker wouldn’t make: broken grammar, a strange salutation (“Dear user”), inconsistent tone. Legitimate companies take care over their communication.

5. A request for sensitive details by email

This one should switch on a red light instantly: no legitimate company will ever ask you for a password, PIN or card number by email. Ever. Not your bank, not Microsoft, not your email provider, not your boss.

If an email contains a form where you’re meant to enter a password, card number or national ID, it’s phishing. Full stop. The same applies if the email tells you to log in via an attached link and you type your password into a page that looks like your bank’s login — at that moment the password goes straight to the attacker.

A typical scenario: the victim enters their card details on a fake page that looks absolutely identical to the real bank. The only difference is the address in the browser — instead of the official domain (say mybank.com) there’s a similar-sounding one with a hyphen or an add-on (mybank-login.com, mybank-verify.net…). Before you type anything, always check the URL.

6. Attachments you weren’t expecting

“Invoice attached”, “Scanned document”, “Your account statement”. If you weren’t expecting the attachment, don’t open it. Especially files ending in .exe, .scr, .zip, .rar, or documents that ask you to “enable macros”.

The most common trick of recent months: an invoice in .pdf format that isn’t actually a PDF. It’s an executable, and Windows hides the extension because you have “hide extensions for known file types” turned on. So you see invoice.pdf when it’s really invoice.pdf.exe.

The fix is simple: turn on file extensions in File Explorer. And if an attachment arrives from an unknown sender — or even a known one, but unexpectedly — verify through another channel that they really sent it.

7. Something feels “off” — trust your instinct

The last sign is subjective, but in my experience the most important: if something about an email doesn’t sit right, you’re probably correct. The human brain is excellent at detecting patterns that don’t fit.

Maybe the logo is slightly blurry. Maybe the email arrived at 3 a.m. Maybe it addresses you as “Dear [email]” instead of your name. Maybe it’s a message from someone who never normally writes to you, suddenly wanting something urgent.

I tell clients: better to check ten times for nothing than to fall for it once. When you’re not sure, call the company or person. With an ordinary phone call — not the number listed in the suspicious email.

What to do if you clicked the phishing link

It happens to careful people too. You’re tired, in a hurry, the email looked genuinely good. If you clicked a link or opened an attachment, here’s the routine I recommend:

Disconnect the computer from the internet immediately. Turn off Wi-Fi, pull the cable. Stop the malware from talking to the attacker’s server.

Change your passwords. Start with the account you may have logged into on the fake page. Then change your email password (if the attacker gets into your email, they can reset passwords for every other service). Use strong, unique passwords for each service.

Scan the computer with antivirus. If you already have antivirus installed, run a deep scan. If you don’t, you’re in a worse spot — the malware may already be active and blocking the installation of security software.

Check your email settings. Look for whether the attacker set up forwarding of your emails to another address, or added suspicious filters. In Gmail it’s Settings → Forwarding and POP/IMAP; in Outlook, Settings → Mail → Forwarding.

Contact your bank. If you entered payment details, call your bank’s line immediately and have the card blocked. Find the support number on the bank’s official website, not in the email.

When you need a professional

Sometimes you can’t manage it alone. The malware hides so well an ordinary antivirus won’t find it. Or the attacker has already changed your passwords and you can’t get to your own accounts. Or you simply don’t want to risk missing something.

That’s when it makes sense to have the machine looked at by a specialist. A proper diagnosis finds what got into the system, removes the malware, and helps you re-secure the accounts. The same applies to data loss or files encrypted by ransomware — the sooner it’s tackled, the better the odds of getting everything back. If you’d rather go through it step by step, see Hacked email or Facebook — a step-by-step recovery guide.