Key Takeaways
- Phishing emails pretend to come from a trusted source to steal passwords, money, or personal data.
- Common warning signs include urgent threats, mismatched sender addresses, suspicious links, and unexpected attachments.
- Never click a link or open an attachment until you have checked where it really comes from.
- Multi-factor authentication (MFA) can protect your account even if your password is stolen.
Phishing is one of the most common ways attackers break into accounts and company networks. Instead of hacking a system directly, the attacker tricks a person into handing over access. The message may look like it comes from your bank, your employer, a delivery company, or a popular online service.
The good news is that phishing emails usually leave clues. In this guide, we explain what phishing is, show 10 warning signs to look for, and describe what to do if you have already clicked.
What Is Phishing?
Phishing is a type of online scam where an attacker sends a message that looks genuine to trick you into doing something harmful. This might mean entering your password on a fake website, sending money, or opening a file that installs malicious software.
Phishing can arrive by email, text message, phone call, or social media message. Email is still the most common method.
10 Warning Signs of a Phishing Email
1. The Sender Address Looks Wrong
The display name may say “Your Bank”, but the actual email address can be something completely different or slightly misspelled. Always check the full address, not only the name.
2. It Creates Urgency or Fear
Messages such as “Your account will be closed in 24 hours” try to make you act before you think. Real organizations rarely demand instant action through email.
3. The Greeting Is Generic
Phrases like “Dear Customer” or “Dear User” can be a sign that the message was sent to thousands of people at once.
4. The Links Do Not Match
On a computer, move your mouse over a link without clicking. The real web address appears at the bottom of the screen. If it does not match the company it claims to represent, do not click.
5. There Are Spelling and Grammar Mistakes
Many scam emails contain odd wording. However, do not rely on this alone, because modern tools can write very clean text, including with the help of generative AI.
6. It Asks for Sensitive Information
Banks and trusted services do not ask for your password, PIN, or full card number by email.
7. There Is an Unexpected Attachment
Be careful with files you did not ask for, especially ZIP files, documents that ask you to “enable content”, or invoices from companies you do not know.
8. The Offer Is Too Good to Be True
Surprise prizes, free gifts, or large refunds are classic bait. If you did not enter a contest, you did not win it.
9. The Message Is Unexpected
A password reset you did not request, a delivery you did not order, or a payment request from a colleague you rarely hear from should make you stop and think.
10. The Request Feels Unusual
A manager who suddenly asks you to buy gift cards or change bank details by email may be an impersonator. Confirm the request through another channel, such as a phone call to a number you already know.
What to Do If You Receive a Suspicious Email
- Do not click any links and do not open attachments.
- Do not reply to the sender.
- Check independently. Go to the company’s official website or app by typing the address yourself.
- Report it. Use the “Report phishing” option in your email service, or tell your IT team if it came to a work account.
- Delete the message after reporting.
What to Do If You Already Clicked
- Disconnect the device from the internet if you opened a suspicious file.
- Change your password immediately on the real website, and anywhere else you used the same password.
- Turn on MFA for your important accounts.
- Run a security scan with a trusted antivirus tool.
- Tell your bank or IT team if you shared financial or work information.
- Watch your accounts for activity you do not recognize.
How to Protect Yourself in Advance
- Use a unique, strong password for each account, and keep them in a password manager.
- Turn on multi-factor authentication wherever it is offered.
- Keep your devices and apps updated.
- Learn how a modern security model limits damage from stolen logins in our guide to Zero Trust security.
- If you run a business, train your team regularly, because people are often the first line of defense.
Frequently Asked Questions
What is the difference between phishing and spear phishing?
Phishing messages are usually sent to many people at once. Spear phishing targets a specific person or company and often includes personal details to look more believable.
Can I get infected just by opening a phishing email?
It is less common today, but possible in some cases. The bigger risk is clicking a link or opening an attachment inside the email.
Does MFA stop phishing completely?
No, but it makes stolen passwords much less useful. Some advanced attacks can still trick people into approving a login, so stay careful even with MFA.
Is phishing only a risk for businesses?
No. Individuals are targeted just as often, usually to steal banking details, social media accounts, or personal information.
Conclusion
Phishing works because it targets people, not machines. By learning the warning signs, checking links and senders, and using MFA, you can stop most of these attacks before they cause harm. When in doubt, pause, verify through a separate channel, and only then act.