How to Spot a Phishing Email (and What to Do If You Clicked)

A phishing email is a message that pretends to come from someone you trust, such as your bank, a delivery company or your employer, to trick you into clicking a link, opening an attachment or handing over passwords and payment details. It remains the most reported type of online crime in the United States. The good news is that most phishing emails share a handful of warning signs, and if you do click, acting quickly can limit the damage. This guide covers both.

How Common Is Phishing?

Very. In the FBI’s Internet Crime Complaint Center (IC3) 2025 report, phishing and spoofing was again the most reported crime type, with 191,561 complaints and reported losses of about $215.8 million. That figure understates the real harm, because phishing is often the first step in bigger frauds, such as business email compromise, account takeovers and investment scams, whose losses are counted separately.

Criminals use phishing because it is cheap and scalable. One convincing template can be sent to millions of addresses, and generative AI tools now make it easier to write fluent, personalised messages without the spelling mistakes that once gave scams away.

What Are the Warning Signs of a Phishing Email?

The US Federal Trade Commission’s guide to recognising phishing and the Cybersecurity and Infrastructure Security Agency (CISA) highlight the same red flags. Look for:

• Urgency or threats: “Your account will be suspended in 24 hours” or “Unusual sign-in detected, verify now”.
• A mismatched sender: the display name says “PayPal” but the actual address is a random Gmail account or a lookalike domain such as paypa1-support.com.
• Requests for sensitive information: legitimate banks and services do not ask you to confirm passwords, PINs or full card numbers by email.
• Suspicious links: hover over a link (or press and hold on a phone) to see the real destination before you tap.
• Unexpected attachments: especially invoices, voicemail files, zipped folders or documents asking you to “enable content”.
• Too-good-to-be-true offers: prizes, refunds or gift cards you did not expect.
• Generic greetings: “Dear customer” instead of your name, although targeted attacks may use your name and job title.

How Can You Check Whether an Email Is Real?

If a message worries you, verify it through a channel you already trust rather than through the email itself:

• Go direct: type the company’s web address yourself or open its official app, and check your account there.
• Call a known number: use the number on the back of your card or on the company’s website, not one in the email.
• Check the full address: look at the domain after the @ symbol, and be wary of extra words, hyphens or swapped letters.
• Ask a colleague or IT team: at work, report suspicious messages using your organisation’s process rather than replying.
• Look at the context: were you expecting a parcel, an invoice or a password reset? If not, treat it as suspicious.

What Are the Most Common Phishing Scams?

• Delivery notices: fake messages claiming a parcel could not be delivered and asking for a small “redelivery fee”.
• Bank and payment alerts: warnings of suspicious transactions that lead to fake sign-in pages.
• Account and password resets: emails mimicking Microsoft 365, Google or Apple asking you to “keep your password” or re-verify.
• Tax and government scams: messages claiming to be from the IRS or another agency about refunds or penalties; the IRS says it does not start contact with taxpayers by email to request personal or financial information.
• Business email compromise: criminals pose as a boss or supplier and ask for an urgent wire transfer or a change to bank details.
• Gift card requests: a “manager” asks you to buy gift cards and send the codes.

Phishing is not limited to email. Texts (smishing), phone calls (vishing) and QR codes (sometimes called quishing) use the same tactics.

What Should You Do If You Clicked a Phishing Link?

Do not panic, but act quickly. The right steps depend on what happened:

• If you only opened the email: in most cases, simply opening a message is low risk. Delete it and report it.
• If you clicked a link but entered nothing: close the page, run a security scan on your device and keep your software up to date.
• If you entered a password: change it immediately on the real website, and anywhere else you reused it. Turn on two-factor authentication and sign out of other sessions.
• If you entered card or bank details: call your bank or card issuer straight away using the number on your card, and ask about blocking the card and disputing charges.
• If you downloaded an attachment: disconnect from the internet, run a full antivirus scan and, at work, tell your IT team immediately.
• If you shared your Social Security number: visit IdentityTheft.gov for a personalised recovery plan and consider freezing your credit with the three main bureaus.

Then keep an eye on your accounts and credit reports for unusual activity over the following weeks.

How Do You Report a Phishing Email?

Reporting helps stop scams reaching others. In the US you can forward phishing emails to the Anti-Phishing Working Group at [email protected] and report fraud to the FTC at ReportFraud.ftc.gov. Forward suspicious text messages to 7726 (SPAM). If you lost money, also file a complaint with the FBI’s IC3. Most email services, including Gmail and Outlook, also have a built-in “Report phishing” option.

How Can You Protect Yourself in Future?

No single tool stops every phishing attempt, but layers of protection make a big difference:

• Use two-factor authentication or passkeys: even if a password is stolen, a second factor blocks most account takeovers. Our guide to passwords, passkeys and two-factor authentication explains the options.
• Use a password manager: it fills in passwords only on the genuine website, so it will not autofill on a lookalike site.
• Keep software updated: updates to your browser, operating system and apps close security holes.
• Turn on email filtering: keep your provider’s spam and phishing protection switched on.
• Consider security software: read whether you need antivirus in 2026.
• Limit what you share: criminals use details from social media to make targeted messages more convincing.

Data breaches also fuel phishing, because leaked email addresses and personal details let scammers tailor their messages. When a company you use reports a breach, such as the recent Capcom ID data breach, expect a wave of related scam emails and be especially careful.

Businesses should go further, with regular staff training, simulated phishing tests, clear reporting procedures and a rule that any change to payment details is confirmed by phone using a known number.

Phishing Checklist at a Glance

• Pause: urgency is the scammer’s main weapon.
• Check the sender: look at the real address, not just the name.
• Hover before you click: confirm where links really go.
• Verify independently: use the official app, website or phone number.
• Never share codes: no genuine company will ask for your one-time passcode.
• If you clicked: change passwords, call your bank, scan your device and report it.

Featured image: Operating a Computer Keyboard MOD 45158106, by Chief Photographer, UK Ministry of Defence / Wikimedia Commons, Open Government Licence v1.0. Cropped, colour-graded and combined with MediaPavilion branding.

Sources

• FBI Internet Crime Complaint Center — 2025 Internet Crime Report (2026).
• Federal Trade Commission — How to recognize and avoid phishing scams (accessed 27 October 2026).
• Cybersecurity and Infrastructure Security Agency — Recognize and report phishing (accessed 27 October 2026).
• Federal Trade Commission — IdentityTheft.gov (accessed 27 October 2026).