Home / Guides / More scam safety

How to Spot a Phishing Email

Phishing emails pretend to be a bank, store or delivery company. They want you to click or log in. Slow down and look for clues.

Step by step

  1. Check the sender address. Not just the name.
  2. Look for urgency. Act now or lose your account.
  3. Hover over links. See the true address.
  4. Do not open attachments. Unless expected.
  5. Go to the site yourself. Type the web address.

What to expect

Expect messages that imitate banks, delivery services and streaming accounts with a link or attachment. They create urgency: your account will be closed, a payment failed, a package is waiting.

Mistakes to avoid

Do not click, open attachments or call numbers in the message. Do not enter passwords after following an email link. Do not forward the message to friends.

A good next step

Go to the company's site yourself, check your account, and report the email as phishing in your mail program.

Ten warning signs, with examples

  • The sender address does not match the company, such as support@paypa1-alerts.example instead of the real site.
  • The greeting is generic: "Dear customer."
  • There is urgency: "Your account will be closed in 24 hours."
  • The message asks you to confirm your password, card number or Social Security number.
  • A link's real address differs from the text you see. Hover on a computer or press and hold on a phone to preview it.
  • There are spelling or grammar mistakes, although AI-written scams are increasingly polished.
  • The attachment is unexpected, especially a zip file or an invoice you did not request.
  • The message claims a package, refund, prize or overdue payment you did not expect.
  • The tone is odd for the sender, such as a friend asking for gift cards.
  • You were not expecting anything from that company.

What to do when you get a suspicious email

  1. Stop. Do not click, reply or open attachments.
  2. Check independently. Open the company's website by typing its address, or call the number on your card or statement.
  3. Report it. Use the Report Phishing or Report Spam button in your mail program, and forward to the company's phishing address if it has one.
  4. Delete it. Once reported, remove it from your inbox.
  5. Warn others. If it came to a group, tell friends and family.

If you already clicked or typed a password

  1. Change the password. Do it right away on the real site, and change it anywhere you reused it.
  2. Turn on two-step sign-in. It blocks thieves who have only your password.
  3. Check recent activity. Look at sign-ins and transactions.
  4. Run a security scan. Use your device's built-in or a well-known security tool.
  5. Call your bank if money is involved. Ask them to monitor or freeze the account.

How AI can help, and how scammers use AI

  • You can paste a suspicious message into an assistant (with names and numbers removed) and ask for a list of warning signs.
  • Do not paste links to open or follow them.
  • Scammers also use AI to write convincing messages in perfect English, so grammar mistakes are no longer a reliable clue.
  • The safest habit is to verify through a separate, trusted channel.

A prompt you can copy

Type this into ChatGPT, Claude or Gemini

Here is an email I got: [paste with personal info removed]. Tell me the signs it could be phishing and what I should do.

Good to know. Your bank will not ask for your password by email.

Want to try this with a friendly teacher?

Join a free live class on Zoom. Small group, no experience needed, no sign-up fee.

Reserve a free seat

Common questions

What if I clicked?

Change your password and call the company using a number you know.

Should I delete it?

Report it as phishing, then delete.

Can I get a virus from opening an email?

Opening is usually low risk, but clicking links or opening attachments can be dangerous.

Is my bank emailing me for real?

Banks do send notices, but they do not ask for your full password or one-time codes. When unsure, log in through the official app or website.

What is the difference between phishing and smishing?

Smishing is phishing by text message. The same rules apply.

Should I block the sender?

Yes, and report it.

More guides