How to spot a phishing or scam email
Phishing emails pretend to come from someone you trust, such as your bank, a delivery company, a supplier or your own boss, to get you to click a link, open an attachment, log in on a fake page or send money.
They're behind a large share of attacks on small organisations, because they target people rather than technology. Once you know the patterns, most are easy to recognise. All examples below are fictional.
Written and reviewed by MaaSec volunteers · Last updated 1 November 2026
How to spot a phishing email: the red flags
- 1The sender address doesn't match. The display name says "Northbank Support", but the actual address is something like [email protected] or a free email account.
- 2It creates urgency or fear. "Your account will be suspended in 24 hours", "unusual login detected", "final notice". Pressure is designed to stop you thinking.
- 3The link doesn't go where it says. Hover over or long-press the link and check the real domain. Our guide how to check if a link is safe explains how.
- 4There's an unexpected attachment, especially a ZIP file, an Office document asking you to "enable content", or a file that claims to be an invoice or voicemail.
- 5It asks for a password, a code or payment details. Real organisations don't ask you to send these by email.
- 6It asks you to change how you pay someone, or to pay an invoice you didn't expect.
- 7It's from your boss or a colleague, but unusual: an urgent, secret request for a payment or gift cards.
- 8Small details are off: a generic greeting, odd spelling, a logo that looks slightly wrong, or a reply-to address that differs from the sender.
Phishing email examples
Red flags: the domain isn't the bank's, there's a 24-hour deadline, and the button leads to a login page on that fake domain.
Red flags: you may not be expecting a parcel at all, and the small fee is a way to collect your card details.
How to identify a scam email: fake invoices and CEO fraud
Two scams cost small businesses and non-profits a lot of money because they don't need any links or malware, just a convincing email:
The rule that stops both: never change bank details or make an unusual payment based on an email alone. Confirm by phone, using a number you already had, not one from the email.
Spam email example vs phishing: what's the difference?
Spam is unwanted bulk email, like ads for products you never asked about. It's annoying but usually not aimed at you. Phishing is a deliberate trick to get something from you: your password, your money or access to your device. When an unwanted email asks you to log in, pay, open a file or act urgently, treat it as phishing.
What to do with a suspicious email
- Don't click links, open attachments or reply.
- If it might be real, contact the organisation through their website, app or a phone number you already know.
- At work, forward it to whoever handles your IT or security, without blame. Fast reporting protects your colleagues.
- Use your email program's "report phishing" or "report spam" button, then delete it.
How to report phishing
- Everywhere: the report button in your email program, and the organisation being impersonated (many banks have a dedicated address for this).
- UK: forward suspicious emails to the National Cyber Security Centre at [email protected].
- US: forward phishing emails to [email protected], and report fraud to the FTC at ReportFraud.ftc.gov.
- If you lost money: contact your bank immediately, then the police or your national fraud reporting service.
What to do if you clicked a phishing link
Act quickly but calmly. If you entered a password, change it right away and turn on two-factor authentication. If you entered payment details, call your bank. If you opened an attachment, disconnect the device and run a security scan. If your email account starts behaving strangely, follow our guide on what to do if your email has been hacked.