How to Spot a Phishing Email: 7 Warning Signs and What to Do
Phishing is when criminals try to get you to open harmful links, emails or attachments that ask for your personal information or infect your device. The US Cybersecurity and Infrastructure Security Agency (CISA) explains in its phishing guide that these messages can arrive by email, text, social media message or phone call. They are usually designed to look like they come from someone you trust. Here is how to spot a phishing email using seven warning signs.
1. Urgent or Emotional Language
CISA lists urgent or emotionally appealing wording as a common sign, especially messages that claim serious consequences if you do not respond immediately. Scammers want you to act before you think.
If a message says your account will close in an hour, pause. CISA’s own example describes a shopper who received an urgent payment-failed email, logged in through its link to a fake site, and had his password and card details stolen.
2. Requests for Personal or Financial Information
Be wary of any message that asks you to send personal or financial details. In our experience, banks, delivery companies and employers rarely ask for passwords or card numbers in a message, so treat any such request as a red flag.
3. Look-Alike Addresses and Links
CISA warns about incorrect email addresses or links, using a misspelling of a well-known shop as its example. Read the sender’s address carefully. The CISA phishing tip sheet also flags addresses that do not match the supposed sender.
On a computer, you can usually see where a link leads by hovering over it before you click. This tip is our own advice.
4. Untrusted Shortened Links
Shortened URLs hide the real destination. CISA lists untrusted shortened links among the common signs. If you cannot tell where a link goes, do not click it.
5. Unexpected Attachments
The same CISA tip sheet lists unexpected attachments as a warning sign. An invoice you never asked for, or a document from a stranger, should make you stop. Confirm with the sender through another channel before you open anything.
6. Do Not Rely on Spelling Mistakes
Poor grammar used to be a giveaway. CISA now notes that in the era of artificial intelligence, some phishing emails have perfect grammar and spelling, so you should look for the other signs. Our guide to spotting AI-generated content online covers related ground.
7. Verify Through Another Channel
If a message might be real, do not click any link or call any number in it. CISA advises finding the company’s contact details on its official website, typing the address in yourself if you are sure of it. For a message from a friend, reach them another way, such as a call or text, to ask whether they sent it.
What to Do: Resist, Report, Delete
CISA’s routine has three steps. Resist the urge to click links or attachments that seem too good to be true. Report the message using the “report spam” button, or by alerting the organization it pretends to be from. Then delete it, without replying or clicking anything, including an unsubscribe link.
Add Safety Nets
Even careful people slip, so layer your defenses. CISA recommends strong passwords with a password manager, multifactor authentication, and prompt software updates. See our guides on securing your AI accounts and protecting yourself from AI-powered cyber threats.
If you do click, our own advice is to change the password for that account right away, turn on multifactor authentication, and contact your bank if you shared card details. Phishing also reaches beyond email. This week, Wiz published research on a case where one Google Search ad click led to stolen credentials and a hijacked cloud billing account. Stay alert on every channel.
