To spot phishing emails, check who really sent the message, hover over every link before you click, and treat any urgent request for passwords, payments or personal details as suspicious until you verify it another way. Most phishing attempts fail at least one of those three checks.
This Voozon.com guide walks you through ten warning signs, a side-by-side comparison with genuine email, and exactly what to do if you have already clicked.
Key Takeaways
- Phishing emails pretend to come from a trusted company or person so you hand over money, logins or personal data.
- Pressure, fear and unexpected requests are bigger red flags than spelling mistakes.
- Always check the full sender address and the real destination of a link before acting.
- Verify any request by contacting the organisation through its official website or app, never through the email itself.
- If you clicked or replied, change your password, turn on multifactor authentication and report the message.
What Is a Phishing Email?
A phishing email is a message designed to trick you into doing something that helps a criminal. That might be typing your password into a fake login page, opening an attachment that installs malware, or paying an invoice that is not real.
The sender usually pretends to be someone you already trust: your bank, a delivery company, a streaming service, a government agency or even your own manager. The disguise is the whole trick, so learning to look past it is the most useful skill you can build.
The US Federal Trade Commission explains that these messages often claim a problem with your account, ask you to confirm personal details or include an invoice you do not recognise. Once you know the common storylines, they become much easier to recognise.
10 Warning Signs of a Phishing Email
No single sign proves an email is fake, but two or three together should make you stop. Work through these clues whenever a message asks you to act.
Sender and Address Clues
- The address does not match the name. The display name says “Support Team”, but the actual address is a random free webmail account or a long string of characters.
- The domain is slightly off. Look for swapped letters, extra words or odd endings, such as a brand name with one character changed.
- You were not expecting it. A refund, prize, shipping notice or password reset you never requested deserves extra caution.
Message and Tone Clues
- Urgency or threats. Phrases like “act within 24 hours” or “your account will be closed” are designed to stop you thinking.
- A request for sensitive data. Legitimate companies rarely ask you to send passwords, card numbers or security codes by email.
- A generic greeting. “Dear customer” from a company that knows your name is a mild but useful clue.
- An offer that is too good. Free gifts, surprise refunds and unclaimed prizes are classic bait.
Link and Attachment Clues
- The link text and destination differ. Hover over a link on a computer, or press and hold on a phone, to preview the real address.
- Shortened or unusual links. Shortened URLs hide where they lead, which is exactly why scammers like them.
- Unexpected attachments. Be wary of invoices, zipped files or documents that ask you to “enable content” before you can read them.
One older rule needs updating. The US Cybersecurity and Infrastructure Security Agency notes that AI tools now help scammers write polished messages, so perfect grammar is no longer a sign that an email is safe.
Phishing Email vs. Legitimate Email
When you are unsure, compare the message against how a genuine organisation normally behaves. This quick reference, which the Voozon.com team uses as a checklist, covers the most common differences.
| What to check | Typical phishing email | Typical legitimate email |
|---|---|---|
| Sender address | Free webmail or a look-alike domain | The company’s official domain |
| Greeting | Generic, such as “Dear user” | Often uses your name |
| Tone | Urgent, threatening or overly excited | Calm and informative |
| Requests | Passwords, codes, card details or gift cards | Asks you to log in through the usual app or site |
| Links | Hidden, shortened or mismatched destinations | Point to the company’s known website |
| Attachments | Unexpected files or macros | Rare, and usually expected |
How to Check a Suspicious Email Safely
You do not need technical skills to investigate a message. You simply need a habit of pausing and checking before you act.
- Pause. Do not click, reply or download anything while you decide.
- Read the full sender address. Tap or click the sender name to reveal the real address behind it.
- Preview the links. Compare the real destination with the company’s official website.
- Go direct. Open the company’s app, or type its web address yourself, and check whether the same alert appears in your account.
- Call a known number. If a colleague or supplier asks for a payment or bank change, confirm by phone using a number you already have.
- Report it. Use your email provider’s “report phishing” option so the filter learns from it.
Strong account security makes any mistake far less costly. A unique password for every account, stored in a tool you trust, means one stolen login cannot unlock the rest of your life. Our guide on whether password managers are safe explains how to set that up.
What to Do If You Already Clicked
Clicking a phishing link is common and fixable, especially if you act quickly. Speed matters more than embarrassment, so start straight away.
- If you entered a password: change it immediately on the real site, plus anywhere else you used the same one.
- If you shared card or bank details: contact your bank using the number on your card or its official app and ask them to monitor or block the account.
- If you opened an attachment: disconnect from the internet, run a full security scan and update your device.
- In every case: turn on multifactor authentication for your key accounts and keep an eye on statements for unfamiliar activity.
Fraud can leave you briefly short of money while a bank investigates. Having savings set aside softens that blow, which is one reason we recommend you build an emergency fund before you need it. You can find more money protection guides in our finance section.
For more practical security and gadget advice, browse the technology articles or explore the Voozon.com guides library across every topic we cover.
Frequently Asked Questions
Can I get hacked just by opening a phishing email?
Simply opening an email in a modern, updated mail app is usually low risk. The danger comes from clicking links, downloading attachments, enabling macros or replying with information. Keep your device and email app updated, avoid loading remote images from unknown senders, and treat every link and attachment in a suspicious message as unsafe.
Why do phishing emails get past my spam filter?
Spam filters catch a large share of junk, but criminals constantly change wording, senders and links to slip through. Messages sent from real but compromised accounts are especially hard to block. That is why your own checks matter: the filter is a helpful first layer, but your judgement is the final one.
Are phishing texts and calls the same thing?
They follow the same playbook through different channels. Phishing by text message is often called smishing, and by phone it is called vishing. The warning signs are almost identical: urgency, unexpected requests, links you did not ask for and pressure to share codes or payment details. Verify through official channels before responding.
Should I unsubscribe from a suspicious email?
No. In a phishing email, the unsubscribe link can be just as dangerous as any other link, and clicking it may confirm your address is active. Instead, mark the message as phishing or spam in your email app and delete it. For genuine newsletters you trust, unsubscribing through the link is fine.
