How to tell if an email is phishing

The 60-second version

1. Look at the sender's real address, not just the name.
2. Ask what the message wants: a login, a payment, a code, an attachment opened.
3. Hover over (do not click) the main link and read the domain it leads to.
4. Check the pressure: a deadline, a threat, a prize.
5. Verify through a channel you already trust, not through the message.

Sender: the name is not the address

Anyone can put "Example Bank" in the display name. What counts is the address behind it and the domain after the @. In most mail programs you can open the sender details by clicking or hovering over the name.

• A display name of a person you know with an address from a free webmail service you do not recognise is a classic impersonation.
• A company name with an address from an unrelated domain is a red flag.
• An address that matches the brand but arrives with failed authentication is worth a look. See what DMARC, SPF and DKIM fail mean.

Reply-To: where your answer really goes

A message can show one sender and quietly send your reply somewhere else. The Reply-To header is how. When you press Reply, check which address fills the To field. If it differs from the sender's domain, stop. The same applies to the hidden Return-Path. Both are visible in the full headers.

Links: read where they lead

• Hover first. The address shown at the bottom of the browser or in the pop-up is the real destination. If the text says one thing and the link goes to another domain, treat it as phishing.
• Read the domain from right to left. In login.examplebank.com.secure-check.example, the domain that counts is the part just before the last dot: secure-check.example, not examplebank.com.
• HTTPS is not a seal of approval. It only means the connection is encrypted. Phishing sites use it too.
• Shortened links and QR codes hide the destination. Be wary of both in unexpected messages. For a shortened link, use a preview feature or skip it.
• When in doubt, open the site by typing its address yourself or using the official app.

Urgency, fear and too-good offers

Phishing works by making you act before you think. Typical triggers are a locked account, an unpaid invoice or fine, a parcel on hold, a security alert, a refund or a prize. Real organisations rarely demand that you log in through an email link within hours or ask for a password, PIN, card number or one-time code by message.

Attachments

• Do not open an attachment you did not expect, even from a known sender whose account may have been compromised.
• Be extra careful with HTML files, archives (ZIP, RAR, ISO), password-protected archives and Office files that ask you to enable macros or editing.
• A PDF can still carry a link to a fake login page.
• If you need to check one, upload the whole message to a checker rather than opening the file.

Lookalike domains

Attackers register addresses that look right at a glance:

Lookalike domains often pass SPF, DKIM and DMARC because the attacker really owns them. That is why passing authentication is not enough.

When to escalate

• You are at work. Report it to your IT or security team, even if you did nothing. Others may have received it too.
• The message asks for money or a change of bank details. Confirm by phone, using a number you already had.
• You clicked or entered something. Go straight to what to do if you clicked a phishing link.
• It impersonates a bank, courier or public office. Report it so it can be blocked.

Let a tool do the tedious part

Reading headers and unwrapping links by hand takes time. Give the whole message to a checker that looks at authentication, the sender chain, every link and attachment and the wording together. To get the headers out of your mail program, see how to view full email headers or save the message as .eml.