- Phishing emails try to trick you into giving away passwords or money.
- They often pretend to be your bank, a delivery company, or a family member.
- A few simple checks can help you spot almost all of them.
Phishing is when a scammer sends a fake email pretending to be someone you trust. The goal is usually to get you to click a link, type in a password, or send money. These emails have gotten much more convincing, but there are still clear warning signs to look for. Once you know what to check, spotting a phishing email becomes second nature.
What does a phishing email usually look like?
Most phishing emails try to create a sense of urgency. They might say your account will be closed, a payment failed, or a package could not be delivered. The email usually asks you to click a link and log in, or to confirm personal details. Real companies rarely ask you to confirm your password by email. When in doubt, that urgency itself is a warning sign.
How do I check who really sent the email?
Look at the sender’s actual email address, not just the name shown. A scammer can make the display name say “Amazon” or “Your Bank,” but the address behind it often gives it away. It might be a long string of random letters, or a domain that’s almost right but not quite, like “arnazon.com” instead of “amazon.com.” Tap or hover on the sender’s name to see the full address before you trust it.
Should I click links in emails?
Be careful with any link in an unexpected email. Before clicking, look at where the link actually goes. On a computer, hovering your mouse over the link shows the real web address at the bottom of the screen. On a phone, a long press often shows the same thing. If the address looks strange, or doesn’t match the company it claims to be from, don’t click it. Instead, go directly to the company’s website by typing the address yourself, or use the app you already have installed.
What if the email seems to be from someone I know?
Scammers sometimes hack a real email account and send messages to everyone in the contact list. If a message from a friend or family member seems unusual, such as an urgent request for gift cards or money, don’t reply to the email. Call or text that person on their usual phone number to check if they really sent it.
What should I do if I already clicked a link?
Don’t panic. If you entered a password on a fake site, change that password right away on the real website. If you gave out financial details, contact your bank immediately to explain what happened. Turning on two-factor authentication adds an extra layer of protection, so a stolen password alone isn’t enough for a scammer to get in.
What should I do with a phishing email?
Most email providers have a “Report phishing” or “Report spam” button. Using it helps your provider block similar emails in the future. Afterward, simply delete the email. There’s no need to reply, even to say “I know this is fake” — replying only confirms to the scammer that your email address is active.
Phishing emails rely on you acting fast, without stopping to think. Slowing down for just a few seconds to check the sender and the link is usually all it takes to stay safe.
Related reading: our guide to robocalls, the phone version of the same trick, and our guide to avoiding online shopping scams.
The Tech Helper is reader-supported. When you buy through links on our site, we may earn an affiliate commission.