Phishing6 min read18 June 2026
How to Spot a Phishing Email: The Complete Guide
Learn practical checks for suspicious sender addresses, urgent language, links, and attachments — and safer next steps if an email worries you.
Phishing emails are designed to trick people into clicking a malicious link, downloading malware, or handing over login credentials or financial details. A message can look polished, so use independent verification rather than appearance alone.
What Is a Phishing Email?
A phishing email impersonates a trusted organisation — a bank, a delivery company, HMRC, Amazon, PayPal, or even your employer — to trick you into taking an action that benefits the fraudster. The email typically creates urgency: your account has been compromised, a payment has failed, a parcel is waiting, or you owe money.
How to Spot a Phishing Email
| What to Check | What to Look For |
|---|---|
| Sender address | Does it match the real domain? (e.g. support@paypa1.com is not PayPal) |
| Greeting | Generic ("Dear Customer") vs. your real name |
| Urgency | Pressure to act immediately is a major red flag |
| Links | Hover over links — does the URL match the claimed sender? |
| Attachments | Unexpected attachments, especially .zip, .exe, or .doc files |
| Grammar | Poor spelling and grammar (though modern AI-generated phishing is often flawless) |
Spear Phishing: Targeted Attacks
Spear phishing is a more sophisticated variant where the attacker researches their target and personalises the email. They may use your name, your employer's name, or reference a recent transaction. These are much harder to detect and are commonly used in business email compromise (BEC) attacks.
What to Do With a Suspicious Email
Do not click any links or download any attachments. If the email claims to be from a company you use, go directly to that company's website by typing the address in your browser. Report phishing emails to the NCSC at report@phishing.gov.uk. If you clicked a link, change your passwords immediately and check your accounts for suspicious activity.
Received a suspicious email? Paste the sender's email address or any links into ScammersCheck for an instant threat check.
Check anything suspicious instantly
Paste a phone number, URL, email address, or suspicious message — get an input-aware risk indicator with transparent evidence and limitations. No signup required.
Check Now — It's Free