How to Spot a Phishing Email: Red Flags and What to Do

Phishing emails are the scammer's favorite tool because they are cheap to send and they only need one person to click. In its 2024 Internet Crime Report, the FBI listed phishing and spoofing as the most-reported type of cyber crime by number of complaints. The good news: almost every phishing email gives itself away if you know where to look. This guide shows you the red flags, the most common scams in plain English, exactly what to do if you already clicked, and where to report a suspicious message in the United States.

What Is a Phishing Email?

A phishing email pretends to come from someone you trust, such as your bank, a delivery company, a streaming service, your employer or even a government agency. Its goal is to get you to act before you think: sign in on a fake page, download malware, buy gift cards or send money. The same trick sent by text message is often called "smishing," and by phone call "vishing." "Spear phishing" is a targeted version that uses your name, job or recent activity to look more convincing.

10 Red Flags of a Phishing Email

You do not need to spot all of these. One or two is enough reason to stop and verify.

1. Urgency or threats. "Your account will be closed in 24 hours," "Unusual sign-in detected," or "Final notice." Scammers rush you so you skip checking.
2. A sender address that does not match. The display name says "PayPal" or "Amazon," but the actual address is a random Gmail account or a lookalike domain such as paypa1-support.com or amazon-account-security.net. Tap or hover on the name to see the real address.
3. Links that go somewhere else. On a computer, hover over a link without clicking and look at the real web address shown at the bottom of the screen. On a phone, press and hold the link to preview it. If the domain is not the company's real one, do not open it.
4. A generic greeting. "Dear Customer" or "Dear User" instead of your name, especially from a company that normally uses it.
5. Requests for sensitive information. Real banks and services do not ask you to email your password, full Social Security number, card PIN or a one-time verification code.
6. Unexpected attachments. Invoices, "shipping labels" or "voicemail" files you were not expecting, especially ZIP, HTML or Office files that ask you to "enable content" or "enable macros."
7. Unusual payment methods. Gift cards, wire transfers, cryptocurrency or payment apps. The FTC warns that anyone who insists on gift cards is a scammer.
8. Too good to be true. A prize you never entered, a refund you did not expect, or a job offer that pays a lot for little work.
9. Poor design or odd wording. Blurry logos, strange spacing, awkward grammar. Be careful, though: many modern scams look polished, so good design alone proves nothing.
10. It does not fit your life. A delivery notice when you have not ordered anything, or a charge for a service you do not use.

Common Phishing Scams (Real-World Examples)

Scammers reuse the same storylines because they work. Here are the ones that land in American inboxes most often.

Scam	What the email says	What it really wants
Account problem	"Your account is locked. Verify your identity."	Your username and password on a fake sign-in page
Package delivery	"We could not deliver your package. Pay a small redelivery fee."	Your card number
Fake invoice or subscription	"Thanks for your $399 payment. Call us to cancel."	To get you on the phone and gain remote access or money
Tax or government	"You have a refund waiting" or "You owe back taxes."	Your Social Security number and bank details
Boss or coworker (business email compromise)	"I need you to buy gift cards for a client, keep it quiet."	Gift card codes or a wire transfer
Shared document	"A file has been shared with you. Sign in to view."	Your work or email password

Notice the pattern: a familiar brand, a problem that feels urgent, and one button that "fixes" it. That button is the trap. The IRS, for example, says it does not start contact with taxpayers by email to request personal or financial information, so an "IRS" email asking for your details is a scam.

How to Check If an Email Is Real

• Go around the message. Open the company's official app or type its web address yourself and sign in. If there is a real problem, you will see it there.
• Call a number you trust, such as the one on the back of your card or on the company's official website, never the number in the email.
• Check the full sender address and the real link destination before anything else.
• Ask someone. If a "boss" or relative asks for money, confirm with a phone call or in person.

What to Do If You Clicked a Phishing Link

Do not panic. Acting quickly limits the damage. Work through the steps that match what happened.

If you entered a password

1. Change that password immediately from the real website or app, and change it anywhere else you used the same one.
2. Turn on two-factor authentication (2FA), ideally with an authenticator app or passkey.
3. Check the account for unfamiliar sign-ins, forwarding rules or recovery details that were changed.

If you shared card or bank details

1. Call your bank or card issuer right away using the number on your card and ask them to block the card and watch for fraud.
2. Review recent transactions and dispute anything you did not make.

If you shared your Social Security number

Visit IdentityTheft.gov, the FTC's site, for a personalized recovery plan. Consider placing a free credit freeze with each of the three credit bureaus, Equifax, Experian and TransUnion, so no one can open new credit in your name.

If you downloaded an attachment

Disconnect from the internet, run a full scan with up-to-date security software, and update your operating system. On a work device, tell your IT team immediately; they would much rather hear it early.

How to Report a Phishing Email

Reporting helps protect others and trains spam filters to catch the next wave.

• Forward the email to the Anti-Phishing Working Group at reportphishing@apwg.org.
• Forward phishing texts to 7726 (which spells SPAM).
• Report it to the FTC at ReportFraud.ftc.gov.
• If you lost money, also file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov.
• Use your email app's report button. Gmail and Outlook both let you mark a message as phishing, which helps their filters.
• Tell the impersonated company. Many have a dedicated address for reporting spoofed emails on their website.

After reporting, delete the email.

Simple Habits That Keep You Safe

• Use a password manager so every account has a unique password; it also refuses to auto-fill on fake sites.
• Turn on two-factor authentication or passkeys for email, banking and social media.
• Keep your phone, computer and browser updated.
• Never share a one-time code someone texts or emails you, no matter who asks.
• Slow down. A ten-second pause is the best defense against urgency.

Related reading: Best time to visit Jaisalmer and Places to visit in Agra.

Frequently Asked Questions

Can I get hacked just by opening a phishing email?

Simply opening an email is generally low risk on an updated phone or computer. The danger comes from clicking links, opening attachments, entering information or replying. Avoid loading remote images in suspicious emails, since they can confirm your address is active.

Should I reply or click "unsubscribe"?

No. Replying or unsubscribing in a scam email confirms your address is real and can lead to more scams. Report and delete it instead.

Why did my email provider not catch it?

Spam filters catch the vast majority of junk, but scammers constantly change wording, domains and senders to slip through. That is why your own judgment still matters.

Can phishing emails come from a real friend's address?

Yes. If a friend's account is hacked, scammers may send messages from it. If a familiar contact sends an odd link or an urgent money request, check with them by phone or text first.

Are phishing emails always full of spelling mistakes?

Not anymore. Many are well written and use real logos. Judge the request, the sender address and the link, not the grammar.

What if the email knows my name or my password?

Scammers often use details from old data breaches to seem believable. If an email quotes an old password, change it everywhere you used it and turn on two-factor authentication, but do not pay or reply.

Conclusion

Spotting a phishing email comes down to a few questions: Is it pushing me to act fast? Does the sender address match? Where does the link really go? Is it asking for something a real company never would? When in doubt, skip the link and go straight to the source. If you slip up, change your passwords, call your bank and report it. A calm minute of checking beats hours of cleanup.