How to Spot a Phishing Email (Complete Guide for 2026)

Phishing emails are one of the most common forms of cyber attack, targeting both individuals and businesses. These emails are designed to trick you into revealing sensitive information such as passwords, banking details, or login credentials.

In this guide, you’ll learn how to spot a phishing email, recognise the warning signs, and protect yourself from becoming a victim.

What is a Phishing Email?

A phishing email is a fraudulent message that appears to come from a trusted source such as a bank, delivery company, or online service.

Its goal is to get you to:

• Click a malicious link

• Download harmful attachments

• Enter personal or financial information

7 Warning Signs of a Phishing Email:

1. Suspicious Email Address:

Always check the sender’s full email address, not just the display name.

Examples:

• support@paypai.com - instead of support@paypal.com (replaced the l with an i)

• security@amaz0n.co.uk - instead of security@amazon.com (replaced the o with a 0)

Even small changes can indicate a scam.

Example

2. Urgent or Threatening Language:

Phishing emails often create panic.

Examples include:

• “Your account will be suspended”

• “Immediate action required”

Legitimate companies rarely pressure you in this way.

3. Unexpected Links or Attachments:

If you receive an unexpected email with a link or attachment, be cautious.

Tip: Hover over links to see the real destination before clicking. When you hover your mouse over a link in an email, your email client (or browser) will show the actual destination URL.

For example:

• Visible link text:https://www.paypal.com/security

• Actual link (on hover):http://paypal-security-login.ru Example Images:

  

  

  

  How to Spot a Phishing Email

Key takeaway:

If the link doesn’t match the legitimate website, or looks unusual (extra words, strange domain, numbers replacing letters), do not click it.

4. Generic Greetings:

Messages that begin with “Dear Customer” or “Dear User” are often suspicious.

Legitimate companies typically use your name.

5. Spelling and Grammar Mistakes:

Poor grammar, spelling errors, and unprofessional formatting are strong warning signs.

6. Requests for Sensitive Information:

No legitimate company will ask for:

• Passwords

• Security codes

• Full banking details

7. Unusual Requests:

If the email asks you to do something unexpected, always verify it first.

What to Do If You Receive a Phishing Email:

If you suspect a phishing email:

• Do not click links

• Do not download attachments

• Do not reply

• Delete the email

• Report it if possible

For businesses, always report it to your IT department.

What If You Clicked a Phishing Link?

Act quickly:

• Disconnect from the internet

• Run a full antivirus scan

• Change your passwords immediately

• Enable two-factor authentication

• Monitor your accounts
  

How to Protect Yourself from Phishing Emails:

• Use strong, unique passwords

• Enable multi-factor authentication (MFA)

• Keep your devices updated

• Use trusted antivirus software

• Be cautious with unexpected emails

Conclusion:

Phishing emails rely on human error rather than technical vulnerabilities. By understanding the warning signs, you can avoid falling victim to these attacks.

Taking a few extra seconds to verify an email can prevent serious consequences.