Phishing emails are messages designed to look like they're from a bank, delivery company, coworker, or well-known service, but are actually trying to steal a password, payment info, or get you to install something harmful. Most are easy to catch once you know what to look for.
1. The sender address doesn't match
Check the actual email address behind the display name, not just the name itself. "Microsoft Support" can still be sending from a strange, unrelated address. If the domain looks off (extra words, misspellings, or a completely unrelated domain), that's a red flag.
2. Urgent or threatening language
"Your account will be suspended in 24 hours" or "Unusual sign-in detected, act now" is a classic pressure tactic. Legitimate companies rarely demand immediate action through email alone.
3. Links that don't go where they claim
Hover over a link (or press and hold on mobile) before clicking, and check where it actually points. If the text says "your-bank.com" but the link goes somewhere else entirely, don't click it.
4. Requests for passwords, codes, or payment info
No legitimate bank, service, or IT support will ask you to email or text your password or a one-time verification code. If a message asks for that, treat it as suspicious by default.
5. Unexpected attachments
An invoice, shipping label, or "important document" you weren't expecting, especially in a .zip or .exe file, is a common way to deliver malware. When in doubt, don't open it.
What to do if you spot one
- Don't click links or download attachments.
- Don't reply, even to say "stop emailing me."
- Delete it, or mark it as spam/phishing if your email provider offers that option.
- If it claims to be from a company you use, contact that company directly through their official site or app, not through the email.
If you've already clicked a suspicious link or entered information, or you just want a second set of eyes on an email that seems off, that's exactly the kind of quick question that's easy to sort out remotely.