Scams
How to spot phishing emails and fake links
Phishing is a message pretending to be someone you trust so you'll click a link, open a file, or hand over a password or payment. The quickest test: check the real sender address, preview where links actually go, and treat any pressure to act immediately as a warning sign.
The red flags that matter most
Bad spelling used to be the giveaway, but modern phishing is often polished. Focus on these signals instead:
- Urgency or fear. "Your account will be closed in 24 hours." "Unusual sign-in detected." "Payment failed." Pressure is designed to stop you from thinking.
- A request to sign in, pay, or share data from a link in the message.
- A sender address that doesn't match. The display name says "Microsoft Support", but the address is something like
support@micros0ft-billing.co. - Links that go somewhere unexpected. The text says one thing; the real destination is another domain.
- Unexpected attachments, especially "invoices", voicemail files, or documents that ask you to enable macros or sign in to view.
- Unusual payment methods. Gift cards, wire transfers, cryptocurrency, or payment apps are favorite scam tools because the money is hard to recover.
- Something that's slightly off. A greeting that doesn't use your name, a logo that looks stretched, or a request your boss or bank would never make by email.
How to check the real sender
- Gmail (web): click the sender's name to see the full address. The "Show original" option in the three-dot menu shows whether SPF, DKIM, and DMARC checks passed.
- Outlook: hover over or tap the sender name to reveal the full address.
- Phones: tap the sender name at the top of the message to expand it.
Read the domain from right to left. In account.paypal.com.secure-login.net, the real domain is secure-login.net, not PayPal. Also watch for lookalikes: rn instead of m, a zero for the letter O, or extra words like "-support" or "-verify".
How to check a link without clicking it
- On a computer: hover the mouse over the link and look at the address shown at the bottom of the browser or email window.
- On a phone: press and hold the link (don't tap) to see a preview of the address, then dismiss it.
- Safest of all: ignore the link. Open your browser, type the company's address yourself or use its official app, and sign in there. If there's a real problem, you'll see it.
A padlock icon or "https" only means the connection is encrypted. Scam sites use https too, so it says nothing about whether the site is legitimate.
Common phishing scenarios
| Disguise | Typical hook | Safe response |
|---|---|---|
| Email or cloud provider | "Mailbox full" or "password expires today" | Sign in through the official site or app to check |
| Bank or card | "Confirm this charge" or "account locked" | Call the number on your card |
| Shipping company | "Delivery failed, pay a small fee" | Track the package on the carrier's site |
| Government agency | Tax refund, penalty, or benefits problem | The IRS typically first contacts you by mail; go to the agency's official .gov site |
| Your boss or a coworker | "Are you available? I need gift cards for a client" | Verify in person or by a known phone number |
| Tech support | Fake security alert with a phone number | Close it; real companies don't ask you to call from a pop-up |
| Vendor invoice | "Our bank details have changed" | Confirm by phone using a number you already have |
Defenses that work even when you slip up
Everyone can be fooled on a busy day. These settings limit the damage:
- Use a password manager. It fills passwords only on the real site's domain, so if it doesn't offer to autofill, that's a warning.
- Turn on two-step verification for email, banking, and social accounts. An authenticator app is better than SMS; passkeys or a hardware security key are better still, because they can't be phished.
- Keep devices and browsers updated. Updates close holes that malicious links and attachments exploit.
- Use unique passwords. One stolen password then unlocks only one account.
What to do if you clicked or replied
- Stop. Close the page. Don't enter anything else.
- If you entered a password, change it right away on the real site, starting with your email account, and change it anywhere you reused it. Sign out of other sessions and turn on two-step verification.
- If you gave financial information, call your bank or card issuer using the number on your card and explain what happened.
- If you opened an attachment or installed something, disconnect from the internet and run a full scan with your security software. On a work device, tell IT immediately.
- If you gave your Social Security number or other identity details, visit IdentityTheft.gov for a personalized recovery plan and consider a free credit freeze with all three bureaus.
- Report it. See below.
Where to report phishing
- In your email app: use Report phishing in Gmail or Outlook.
- Anti-Phishing Working Group: forward phishing email to reportphishing@apwg.org.
- FTC: report scams at ReportFraud.ftc.gov.
- FBI Internet Crime Complaint Center: report losses at ic3.gov.
- The impersonated company: many have a dedicated address or page for reporting phishing; find it on their official site.
Frequently asked questions
What's the difference between spam and phishing?
Spam is unwanted bulk mail, usually advertising. Phishing is deliberate deception meant to steal credentials, money, or personal data. All phishing is unwanted, but not all spam is phishing.
Can a phishing email come from a real company's address?
Yes. Attackers sometimes send from hacked legitimate accounts, or abuse real services such as file-sharing or invoicing tools to send messages. That's why you should judge the request itself, not only the sender.
Do passkeys protect against phishing?
Largely, yes. Passkeys are tied to the real website's domain, so a fake site can't use them. Turning on passkeys or a security key for your email and financial accounts is one of the strongest defenses available.