How to Spot Phishing Emails Before You Click

Why phishing emails still catch careful people

Most of us like to think we would spot a scam a mile off. Yet phishing messages continue to work precisely because they arrive at the worst possible moment — while you are hurrying out of the door, chasing a missing parcel, or half-watching television with your phone in one hand. They rely on speed and pressure rather than on your intelligence, and the better ones are written in flawless, friendly English.

The reassuring part is that a short, repeatable checking routine will catch the overwhelming majority of them, and it takes less than a minute. Here is what to look at, in the order that matters most.

Check the sender address, not the display name

The name that appears in your inbox is just a label, and anyone can set it to anything. An email can proudly announce itself as coming from "Your Bank" while the actual address behind it tells a very different story. On most apps you can tap or click the sender's name to reveal the full address.

When you do, read it from right to left, because the part that matters is the bit immediately before the first single forward slash — the domain. Look out for:

• Extra words bundled in, such as "secure", "verify", "billing" or "support" either side of the real brand name.
• Small spelling swaps that are easy to miss: a doubled letter, an "rn" standing in for an "m", or a hyphen where there should be none.
• Unusual endings. A UK bank or council will not be writing to you from a random overseas domain.
• A reply-to address that differs from the sender address — a classic sign that replies are being funnelled somewhere else.

If the display name says one thing and the domain says another, stop there. You do not need to read any further.

Hover over links before you click

On a computer, rest your mouse pointer over a link without clicking it and the true destination will appear, usually in the bottom-left corner of the screen. Compare that address with the text of the link. If the visible words say one thing and the destination says something unrelated, that is a phishing email.

Bear in mind that a link displayed in an email is only the label, never the destination. Text can say anything at all, including a perfectly correct-looking web address, while pointing somewhere completely different.

On a phone or tablet you cannot hover, so press and hold the link instead and a preview of the address will usually pop up. If nothing appears, do not guess — close the email and reach the organisation the way you normally would, by typing its address into your browser or opening its app. That single habit defeats a huge share of phishing attempts, because you arrive at the genuine site and can check your account there directly.

The red flags: urgency, secrecy and requests for personal details

Almost every phishing email needs you to act before you think. Phrases to treat as warning signs include:

• Urgent deadlines. "Within 24 hours", "your account will be suspended today", "final notice" — real organisations rarely operate this way, and they do not mind you taking a day to check.
• Requests for personal details. Passwords, PINs, full card numbers, National Insurance numbers or one-time security codes. No legitimate bank, energy supplier or government service will ask for these by email.
• Requests to move a payment. Any message asking you to pay a fee to release a parcel, claim a rebate or unlock an account should be treated as hostile until proved otherwise.
• Generic or slightly wrong greetings. "Dear Customer" from a company that normally uses your name is worth a second look, as is an email addressed to the wrong title or an old name.
• Odd formatting. Blurred logos, mismatched fonts and buttons that do not match the rest of the message are all clues, though their absence proves nothing.

Poor spelling and grammar used to be a giveaway, but many modern attempts are polished and professional. Judge the message on what it is asking you to do, not on how nicely it is written.

Attachments, invoices and changed bank details

Be wary of unexpected attachments, particularly invoices, receipts or delivery notes you were not expecting. Files ending in .zip or .html, and document files that ask you to "enable editing" or "enable content" before they will display properly, are common ways of delivering malware.

One of the costliest scams for households and small businesses involves a message claiming that a supplier or regular payee has changed their bank details. If you receive anything like this, never use the phone number or address in the email to check. Ring the number you already have on file, or log in to the account through your usual route, and confirm the change independently.

If you have already clicked — and habits that keep you safe

Try not to panic. Clicking a link is not the same as handing over information. If you entered details, change that password immediately, and anywhere you have reused it. Contact your bank straight away if card or account details were involved, and report the message to the national fraud reporting service. Run any available security update on the device, then delete the email or mark it as spam.

Longer term, a few quiet habits do most of the work: slow down when a message demands speed, verify anything financial through a channel you chose yourself, use multi-factor authentication, and keep your devices updated. Treat every unexpected email as a claim to be checked rather than an instruction to be followed, and you will avoid nearly all of them.