To spot phishing emails, verify the sender's real address, inspect links before opening them, and treat unexpected requests for passwords, payments, files, or urgent action as suspicious until you confirm them another way. The most useful phishing indicators are structural, not grammatical: a polished message can still come from a lookalike domain or lead to a harmful site.
For a small business, one rushed click can expose an inbox, trigger a fraudulent payment request, or give an attacker a path toward client data. For individuals, it can lead to account takeover or identity fraud. The safest response is simple: pause, do not use the email's link or reply button, and contact the organization or person through a known phone number, app, or saved website.
Quick Answer
Check the full sender address, hover over links, and independently verify unexpected requests involving money, credentials, attachments, or sensitive information. Urgency, a generic greeting, unusual branding, and a request that does not fit your relationship with the sender are common signs of a phishing email. If you clicked, change any exposed password, enable MFA, and report the message promptly.
What to remember before you click
Do not judge an email by spelling alone. Verify the sender, destination, and request. Use a separate communication channel for payment or credential requests, and protect important accounts with unique passwords and multi-factor authentication.
12 phishing email red flags to check
One red flag does not prove a message is malicious. Several mismatches, or one high-risk request, are enough reason to stop and verify before acting.
1. The display name and sender address do not match
Email clients often show a friendly name first. Open the sender details and compare the actual address with the organization it claims to represent.
2. The domain contains a small change
Look for added words, hyphens, substituted characters, or letters that resemble numbers. A message can look like it came from a familiar brand while the actual domain is unrelated.
3. It creates unusual urgency
Threats of account closure, legal trouble, missed deliveries, or an immediate payment deadline are designed to make you act before checking. A real deadline can exist, but you can verify it from the organization's official site or phone number.
4. The request is unexpected
Be cautious with an invoice from an unknown vendor, a password reset you did not request, or a shared file you were not expecting. A familiar sender can also be compromised, so context matters.
5. It asks for passwords, codes, payment details, or personal data
Do not enter sensitive information through a link in an unexpected email. The IRS says it does not initiate contact with taxpayers by email or text message to request personal or financial information.
6. The link destination differs from the link text
Hover over a link without selecting it and inspect the destination. If it does not lead to the expected official domain, close the message and go to the site yourself using a saved bookmark or typed address.
Phishing checklist before opening a link or attachment
- I checked the full sender address, not only the display name.
- I confirmed that the request fits my relationship with this sender.
- I inspected the link destination without clicking it.
- I will verify any request involving money, credentials, or client data through a known contact method.
- I will not open an unexpected attachment or enable document macros.
7. An attachment arrives without context
Unexpected archives, executable files, shortcut files, and macro-enabled Office documents deserve extra caution. Confirm the request through a separate channel before opening a file, especially if it claims to be an invoice, résumé, shipping document, or shared report.
8. The branding or wording is slightly wrong
Poor grammar, broken images, odd spacing, or outdated logos can be useful clues. They are not required for phishing, though, because attackers can copy legitimate branding and generate convincing text.
9. It arrived at an address that does not fit the claimed account
A bank notice sent to an email address you use only for another service may be a mismatch worth investigating. Do not follow the message's instructions to find out.
10. Footer links point somewhere different
Inspect privacy, unsubscribe, and support links when the message is suspicious. A mismatch between the sender domain and the destinations can reveal a copied template or deceptive routing.
11. The message asks you to bypass normal approval steps
Requests to change banking details, buy gift cards, send tax documents, or keep a transaction confidential should be verified by phone or another trusted channel. This applies even when the message appears to come from an executive, vendor, colleague, or family member.
12. You feel pressured to act before checking
Urgency, authority, fear, and curiosity are common social-engineering triggers. Treat the feeling of being rushed as a prompt to slow down and verify.
Payment requests need an out-of-band check
According to the FBI Internet Crime Complaint Center's 2025 Annual Report, business email compromise caused more than $2.9 billion in reported losses in 2025. Before sending funds or changing payment instructions, call a known contact number already on file, not a number supplied in the email.
Why targeted phishing is harder to recognize
Spear phishing is a targeted message that uses real details about a person, business, client, or project to appear credible. Whaling is a form of spear phishing aimed at executives or people with financial authority. Business email compromise, often called BEC, involves deceptive email requests that seek payments or sensitive information, sometimes from a compromised legitimate inbox.
Because targeted messages may use your name and accurate work details, a generic greeting or spelling error is not a dependable test. Verify the specific request instead. A request to approve a wire, download a file, reset a password, or disclose client information should be confirmed through a separate channel.
Small firms should make this routine: no bank-detail change, client-record request, or payment instruction is completed solely from an email. Pair that process with unique passwords and password security practices and multi-factor authentication for email, banking, payroll, and tax-related accounts. Tax professionals can also review the site's guide to IRS tax professional account MFA setup.
What to do if you clicked a phishing link
Stop interacting with the page
Close the page and do not enter more information, download files, or approve MFA prompts.
Change exposed passwords
Change the password for any account you entered on the page, starting with email and financial accounts. Replace reused passwords on other accounts as well.
Turn on or review MFA
Enable multi-factor authentication on affected accounts. An authenticator app or passkey can provide stronger protection than a password alone.
Notify the right people
Tell your IT or security contact immediately if a work device, business account, or client information may be involved. Contact your financial institution using a trusted number if payment data was exposed.
Report and monitor
Use your email provider's phishing-report option and monitor affected accounts for unauthorized activity. The FTC provides reporting guidance at reportfraud.ftc.gov.
Use technical checks as supporting evidence
Email authentication results can help a security professional assess whether a message was authorized by the claimed domain. SPF identifies whether a sending server is authorized, DKIM checks a cryptographic signature on the message, and DMARC checks alignment between the visible From domain and authentication results.
A failed result can be a strong reason to investigate, but a passed result does not make every request safe. Attackers can send from a real compromised account or use a legitimate service. The Cybersecurity and Infrastructure Security Agency recommends recognizing and reporting phishing, then contacting the organization through a known, legitimate channel rather than using the suspicious message.
For a small office, prevention also includes endpoint protection and a clear reporting path. If a malicious link or attachment reaches a workstation, endpoint detection can help identify suspicious activity after the initial email control has failed. Learn what to evaluate in endpoint detection for small businesses.
Practice the verification habit
Use the same pause-and-verify process for suspicious texts, especially delivery notices, account alerts, and payment requests.
Build phishing resistance into everyday work
People are the last check, not the only check. Use MFA, unique passwords, email filtering, protected endpoints, backups, and a process for reporting suspicious messages. Security awareness training is most useful when it reinforces the exact decisions people make, such as verifying payment requests and reporting a suspicious attachment quickly.
For owners and office managers, document who can approve payments, how vendor banking changes are verified, and where employees report questionable messages. This reduces confusion during a real incident and creates a practical control around the requests attackers commonly imitate.
Get Your Free Personal Security Review
Review your phishing exposure, account protection, and practical next steps with a security professional.
Frequently Asked Questions
Treat accurate personal details as a reason to verify the request, not proof that the message is legitimate. Check the full sender address and independently confirm unusual requests involving money, credentials, files, or sensitive information.
No. Spam is unsolicited bulk email, often promotional. Phishing is a deceptive message intended to obtain information, money, or account access, or to get the recipient to open a harmful link or attachment.
Yes. A compromised account can send malicious or deceptive messages from a real address. Verify unusual requests through a phone call or another communication method that is separate from the email thread.
Do not click links, open attachments, reply, or use contact details in the message. Report it through your email provider, then contact the claimed organization through a known website, app, or phone number if verification is needed.
Start with the concern that matters most
Make your accounts, devices, or family safer one clear step at a time
You do not need to change everything today. Choose the account, device, scam, or family concern that brought you here and fix the highest-impact opening first.
People also look for
Keep exploring Phishing & email security
Recognize manipulation, protect email accounts, and give people a clear way to report suspicious messages.
- Common question: what is phishingUnderstand how phishing worksLearn the common phishing types, why they work, and what attackers want.
- Common question: email security best practicesUse the email security guideCombine account protection, filtering, safer habits, and reporting procedures.
- Common question: social engineering examplesRecognize social engineering tacticsSee how pretexting, impersonation, urgency, and authority are used to manipulate people.
- Common question: security awareness trainingBuild practical security awarenessHelp employees recognize threats and respond without creating a blame culture.
- Common question: phishing protection for tax officesProtect a tax office from phishingAddress the impersonation and credential-theft risks that rise during tax season.
