Is This Email Real? How to Spot a Phishing Email Before You Click

Here is what's actually true: most dangerous emails don't look dangerous. They look like a note from your bank, a delivery company, or a store you shop at. The FBI's latest annual report on internet crime listed phishing and spoofing as the single most-reported category, with more than 190,000 complaints in 2025. Anyone can be fooled, so the goal isn't to be perfect. It's to build a few habits that catch most of them.

What "phishing" actually means

Phishing (pronounced "fishing") is when a scammer sends a message pretending to be someone you trust, hoping you'll "bite." The bite is usually one of three things: clicking a link that leads to a fake website, opening an attachment that installs harmful software, or replying with private information like a password or Social Security number. The FTC notes that these messages often claim an invoice is overdue or ask you to confirm account details.

Five warning signs worth knowing

1. Pressure and panic. "Your account will be closed in 24 hours" is designed to make you act before you think. Real companies rarely threaten you by email.

2. A sender address that's slightly off. The name on the message can say anything, because anyone can type any name. Tap or hover over it to see the actual address. Something like support@paypa1-billing.com (note the number 1 in place of the letter l) is a fake.

3. A link that goes somewhere else. On a computer, hover your mouse over a link without clicking and the real destination appears at the bottom of the window. On a phone, press and hold the link to preview it. If the web address doesn't match the company, don't open it.

4. An unexpected attachment. Invoices, voicemails, and "shared documents" you weren't expecting are a classic way to deliver harmful software. If you didn't ask for it, don't open it.

5. A request for something no real company asks for by email: your full password, a gift card, a payment by wire transfer, or your Social Security number.

"But it looked perfect!" Why good fakes exist now

You may have heard that scam emails are full of spelling mistakes. That used to be a reliable tell, but it isn't anymore. Scammers can now use AI writing tools to produce clean, natural-sounding messages, and they can copy a real company's logo and layout in seconds. Don't judge an email by how polished it looks. Judge it by what it asks you to do. A flawless email that asks you to click a link and "verify" your account deserves more suspicion, not less.

The one habit that beats nearly all of them

Don't use anything in the email. Instead, go to the company yourself. Type the website address into your browser, open the company's app, or call the phone number printed on the back of your card or on a past bill. If there's really a problem with your account, it will be waiting for you there. This works because the scammer controls the email but not the real website. It's the same advice the FTC gives: if a message might be legitimate, contact the company using a phone number, email, or website you already know is real.

What to do today

First, make sure your spam filter is on. Major email services such as Gmail, Outlook, and Yahoo turn it on by default, and marking junk as spam teaches it to catch more. Second, turn on two-factor authentication (a second step, like a code sent to your phone, when you sign in) for your email and bank accounts. Then even a stolen password isn't enough to get in. Third, tell the people in your family who are less comfortable with technology about the "go to the company yourself" habit. It takes ten seconds to explain.

If you already clicked

Don't panic. Clicking a link alone usually does no harm; the danger is in what you do next. If you typed in a password, change it right away on the real website, and change it anywhere else you used the same one. If you gave a card number, call your bank using the number on the card. If you opened an attachment, run a scan with your computer's built-in security tool (Windows Security or your Mac's protections) and restart. If you shared a Social Security number, visit IdentityTheft.gov for a recovery plan.

Report it, then delete it

Reporting helps protect others. Forward phishing emails to reportphishing@apwg.org (run by the Anti-Phishing Working Group) and file a report at ReportFraud.ftc.gov. After that, delete the message.

Sources: FTC Consumer Alerts, "Protect yourself from phishing scams" (consumer.ftc.gov); FBI Internet Crime Complaint Center 2025 Internet Crime Report, as summarized by Help Net Security (April 2026).