How to Spot a Phishing Email (and What to Do If You Clicked)
The warning signs of phishing emails and texts, real examples of common scams, and exactly what to do in the first ten minutes if you fell for one.
Phishing is when someone pretends to be a company or person you trust, to get you to click a link, enter a password or send money. It's the most common way people get hacked, and it doesn't need any technical skill. Just a convincing message and a moment of distraction.
The good news: most phishing messages share the same tells once you know where to look.
The six warning signs
1. Urgency or fear
"Your account will be closed in 24 hours." "Unusual sign-in detected." "Final notice: payment failed." Scammers want you to act before you think.
2. The sender address is slightly off
The display name says "PayPal", but the actual address is service@paypa1-secure.com or a random Gmail account. Tap or hover on the sender's name to see the real address.
3. The link doesn't go where it says
Hover over a link (or long-press on a phone) to preview the real destination. If an "Amazon" email links to amazon-account-verify.xyz, it's fake.
4. It asks for passwords, codes or payment details
Real companies don't email asking for your password, and they never need the 2FA code you just received. Anyone asking for that code is trying to break into your account.
5. Generic greetings and odd details
"Dear Customer". An order you never placed. A delivery for a parcel you're not expecting. AI has made the spelling and grammar in scams much better, so don't rely on typos to spot them anymore.
6. Unusual payment requests
Gift cards, crypto, wire transfers to a "new" bank account, or a "boss" texting urgently to buy gift cards for a client. These are classic scams.
Common scams right now
- Fake delivery texts: "Your parcel couldn't be delivered, pay a $1.99 fee." The fee is tiny; the goal is your card details.
- Fake invoices for software or antivirus renewals you never bought, with a phone number to "cancel".
- Account security alerts linking to a perfect copy of a login page.
- CEO fraud: an email from your "manager" asking for an urgent payment or gift cards.
- QR code phishing: a QR code in an email or on a sticker that leads to a fake login page.
The golden rule
Don't use the link or phone number in the message. Open the app or type the website address yourself, or call the number on the back of your card. If the problem is real, you'll see it there.
If you clicked or typed your password
Don't panic. Move fast:
- Change that password immediately, from the real website, and anywhere else you used it.
- Turn on two-factor authentication if you haven't. Here's how to set it up properly.
- Sign out of all sessions. Most services have a "sign out everywhere" option in security settings.
- If you gave card details, call your bank using the number on your card. They can block the card.
- If you downloaded a file, run a full scan. See Is Windows Defender enough?
- Report it to the real company, and to your country's fraud reporting service.
- Warn people if the scam came from a friend's hacked account.
How to protect yourself long-term
- A password manager helps more than you'd think: it won't autofill your password on a fake site, which is an instant warning sign. See 1Password vs Bitwarden.
- Passkeys can't be phished at all.
- Slow down. Most phishing works because people are rushing. A 10-second pause catches most scams.
