Phishing emails are messages that pretend to come from someone you trust, such as your bank, a delivery company or even your boss, to trick you into clicking a link, opening a file or sharing information. They remain one of the most common causes of hacked accounts. This Technicalinterest.Com guide shows you how to spot phishing emails using twelve clear warning signs.
Key takeaways
- Urgency, threats and unexpected requests are the biggest warning signs.
- Always check the real sender address and the real link destination.
- Real companies never ask for passwords or one-time codes by email.
- Password managers and passkeys help protect you from fake login pages.
- If you clicked, change passwords quickly and contact your bank if needed.
Why phishing still works
Phishing works because it targets people, not computers. Scammers create urgency, fear or excitement so you act before you think. Many now use AI to write flawless, personalised messages, so the old advice to look for spelling mistakes is no longer enough. The US cybersecurity agency CISA explains the basics in its guide to recognising and reporting phishing.
12 warning signs of a phishing email
- Urgency or threats: “Your account will be closed in 24 hours” is designed to rush you.
- A mismatched sender address: the display name says “Bank Support”, but the actual address is a random or misspelled domain.
- Links that do not match: hover over a link (or long-press on a phone) to preview the real address before you tap.
- Requests for passwords or codes: real companies never ask for your password or one-time code by email.
- Unexpected attachments: invoices, “shipping labels” and zipped files you were not expecting.
- Generic greetings: “Dear customer” from a company that normally uses your name.
- Too-good-to-be-true offers: prizes, refunds or crypto returns you never applied for.
- Payment changes: a supplier or colleague suddenly asks you to pay into a new bank account.
- Gift card requests: a “manager” asking you to buy gift cards urgently is a classic scam.
- Odd formatting or logos: blurry branding or unusual layouts compared with real emails.
- Login pages that look slightly off: a password manager that does not offer to fill your details is a strong clue.
- Your gut feeling: if a message feels strange, verify it through another channel.
Common phishing scams to recognise
Delivery and parcel scams
Messages claim a parcel is waiting and ask for a small fee or your address details. Check deliveries directly on the courier’s official app or website.
Account security alerts
Fake “suspicious sign-in” warnings send you to a copied login page. Open the app or type the website address yourself instead.
Business email compromise
Attackers impersonate executives or suppliers to redirect payments. Always confirm payment changes by phone using a number you already know.
How to protect yourself
- Use a password manager, which will not autofill on fake websites.
- Turn on two-factor authentication, and switch to passkeys where available, because they resist phishing.
- Keep your devices and browser updated; our guide to Windows 10 end of support explains why outdated systems are riskier.
- Be cautious with browser add-ons that request broad access, as covered in safe browser extensions.
What to do if you clicked a phishing link
- Do not enter anything else. Close the page.
- If you entered a password, change it immediately on the real website, along with any account that reused it.
- If you shared bank details, contact your bank straight away using the number on your card.
- Run a security scan if you downloaded or opened a file.
- Report the email to your provider and, where available, to official reporting services such as the ReportFraud.ftc.gov in the US.
Remember: pause, verify, then act. No genuine organisation will be upset that you checked first.
Phishing beyond email
The same tricks appear in text messages (smishing), phone calls (vishing), social media direct messages and QR codes placed on posters or parking meters. The warning signs are identical: urgency, unexpected requests and links or numbers you did not look up yourself. Background on how these scams evolved is available in this overview of phishing.
Teach family members, especially older relatives and teenagers, a simple rule: never act on a message that asks for money, codes or passwords until you have checked it with someone you trust.
Practise with your team
Businesses can run short, friendly phishing awareness sessions so staff learn to report suspicious emails quickly rather than feel embarrassed.
Frequently asked questions
Can opening a phishing email infect my device?
Simply opening an email is rarely enough on an updated device. The danger usually comes from clicking links, opening attachments or entering information.
How do I check where a link really goes?
Hover over the link on a computer, or press and hold it on a phone, to preview the full address. Make sure the domain exactly matches the real company.
Should I reply to a phishing email?
No. Replying confirms your address is active. Report or delete the message instead.
Are phishing text messages common?
Yes. Text-message scams about deliveries, bank alerts and unpaid tolls are very common. Treat links in unexpected texts with the same caution as email links.
Stay one step ahead of scammers with more guides in the Cybersecurity hub on Technicalinterest.Com.
