A phishing email is a message that impersonates a trusted sender to steal your credentials, money, or data - and you spot one by checking three things in order: does the sender's actual domain match who they claim to be, does the link's real destination match its visible text, and does the message pressure you to act immediately. If any one of those three fails, treat the email as a scam until proven otherwise.
What is a phishing email, exactly
A phishing email is a fraudulent message built to look like it came from someone you trust - a bank, a delivery company, your email provider, a coworker - with the sole purpose of getting you to click a link, open an attachment, or reply with information you'd never otherwise hand over. The word comes from "fishing": the attacker casts a wide net of near-identical messages and only needs a small percentage of recipients to bite. Phishing is a form of social engineering, not a technical exploit - it targets human judgment, not a software vulnerability.
We built Email Scam Checker specifically because most people can spot an obvious phishing email but miss the well-crafted ones - and the well-crafted ones are the only kind that still work at scale. Every red flag below is one we run as an automated check across Gmail, Outlook, Yahoo Mail, and Proton Mail, so this isn't theoretical advice; it's the same list our detection logic looks for.
Why phishing still works, at scale, every single quarter
Phishing isn't a fringe threat. The FBI's 2025 Internet Crime Report recorded phishing as the most commonly reported cybercrime category, with email-based fraud categories - phishing, business email compromise, and government impersonation combined - crossing $4 billion in reported losses. The Anti-Phishing Working Group's Phishing Activity Trends Report has repeatedly logged more than 800,000 unique phishing attacks in a single quarter. Attackers don't need a high success rate when the volume is that large - they need you to be the one recipient out of a thousand who's in a hurry.
Sender and domain red flags
The single highest-value check is also the one most people skip: does the sender's actual domain - not the display name - match who they claim to be? A message can display "PayPal Support" while the underlying address is something unrelated entirely, and most mail clients hide the real address behind the display name by default.
Watch for three specific domain tricks. A suspicious domain uses a real brand name inside a domain that isn't the brand's own, like "paypal-secure-alert.com." A typosquatted domain is a near-miss misspelling - "paypa1.com" or "netflx.com" - one or two characters off from the real thing. A homoglyph domain swaps in a visually identical character from another alphabet, like a Cyrillic "а" standing in for a Latin "a," so the domain looks correct at a glance but isn't.
Link red flags
The second check is whether a link's visible text matches where it actually goes. Hover over any link (don't click) and compare the destination shown in your browser's status bar to what the text claims. A link labeled "Sign in to your account" that resolves to a domain with no relation to the sender is the single most common pattern in real phishing emails.
Beyond a simple text mismatch, look for URL shorteners (bit.ly, tinyurl) or redirect wrappers hiding the real destination, links pointing to a raw IP address instead of a domain, high-risk domain endings like .xyz or .tk that are disproportionately used in phishing campaigns, and a particularly sneaky trick where a real brand's domain is embedded inside an unrelated one - "paypal.com.phishing.xyz" - to look legitimate inside a crowded address bar.
Language and psychological red flags
Phishing emails lean on urgency because urgency short-circuits careful reading. Phrases like "your account has been suspended," "verify now," or "action required within 24 hours" are designed to get you clicking before you check anything else. Combine that with a generic greeting ("Dear Customer" instead of your actual name), multiple grammar mistakes, or a request to "sign in to verify your identity" via a link - something legitimate companies essentially never ask for by email - and you're looking at a strong cluster of red flags rather than one weak signal.
One specific phrase worth knowing: the word "kindly" in a business context ("kindly send the payment") is a strong signal of scam operations, and it almost never appears in genuine corporate correspondence in that phrasing. It's a small tell, but it's a remarkably consistent one.
These wording checks are built primarily for English-language emails, since scam phrasing patterns don't translate literally between languages. The highest-value ones - urgency language, credential-harvesting requests, and financial-scam wording - also recognize common Russian-language scam phrasing, which matters if you correspond in more than one language and get targeted in both.
Financial scam and manipulation red flags
Beyond generic urgency, a distinct cluster of red flags targets your money directly, and business email compromise is the version that costs victims the most. It rarely includes a malicious link at all - just a convincing request from someone posing as your boss or a vendor, asking for a wire transfer, gift cards, or a change to invoice payment details. Watch for the same pattern in gift-card requests ("buy five $100 cards and send the codes"), sudden inheritance or lottery windfalls, and sextortion emails claiming to have compromising footage - all rely on the same mix of urgency and authority pressure rather than a technical exploit.
A related trick worth knowing: an email that repeatedly mentions a well-known brand in the body but is sent from a domain that has nothing to do with that brand - a classic sign the sender is borrowing the brand's credibility without actually being them. (This doesn't apply when a company legitimately invites you to "follow us on X" or "join our Discord" inside its own newsletter - mentioning a social platform isn't impersonation.)
Two more technical tells that most guides skip entirely. A Reply-To mismatch is when an email displays as coming from "[email protected]" but hitting reply would actually send your response to a completely unrelated address - visible in the header if you check it, and something Gmail surfaces reliably. A generic action-link mismatch is when a button labeled something vague like "Click Here" or "Verify Now" - rather than spelling out a URL in the visible text - points somewhere unrelated to the sender's own domain. It's the single most common pattern in real phishing links, precisely because it doesn't require the attacker to show you a suspicious address at all.
Attachment and hidden-content red flags
Executable file types disguised as documents - .exe, .scr, or .js files with a document-style name - are a hard stop; no legitimate invoice or shipping notice needs to run code on your machine. A subtler trick is content hidden with CSS (invisible or zero-size text) that isn't visible in the rendered email at all, used specifically to slip scam phrasing past keyword-based filters while showing you something entirely different on screen.
A real phishing email example, annotated
Here's a pattern we see constantly: an email claiming to be from Coinbase, subject line "Your account has been suspended - verify immediately," sent from a domain like "coinbase-secure-verify.com" rather than coinbase.com. The body greets you with "Dear Valued Customer," includes a "Verify Now" button whose underlying link points to a URL shortener, and closes with a 24-hour deadline before "permanent account closure."
Every element in that message is a red flag on its own - a suspicious lookalike domain, a generic greeting, a shortened link, and manufactured urgency - and together they're unambiguous. This is also exactly the kind of message where an anti-phishing code check earns its keep: if you'd configured your real Coinbase security phrase in advance, its absence (or a wrong code) from this email would be a critical, immediate tell, independent of everything else.
Legitimate email vs phishing email at a glance
| Signal | Legitimate email | Phishing email |
|---|---|---|
| Sender domain | Matches the company's real domain exactly | Lookalike, typosquatted, or unrelated free-mail domain |
| Greeting | Uses your actual name | "Dear Customer" or "Dear User" |
| Links | Visible text matches destination domain | Visible text and destination don't match |
| Tone | Informational, no artificial deadline | Urgent, threatens account loss or legal action |
| Footer | Unsubscribe link and physical address present | Missing or generic footer, no real address |
When a legitimate email sets off false alarms
Not every email that trips one of these red flags is actually a scam. Genuine marketing emails from platforms like HubSpot, Mailchimp, or SendGrid sometimes use urgency language ("Sale ends tonight") that superficially resembles phishing pressure tactics - the difference is context, a working unsubscribe link, and a real physical address in the footer, all of which are positive signals that offset a single borderline red flag. A message from a company's legitimate support team can also look like impersonation if it uses a generic "Support" or "Team" identity - that's normal, not a red flag, as long as the underlying domain still matches.
Once you can tell a genuine false alarm from a real one, the next step is knowing exactly what to do in each case.
What to do the moment you spot a phishing email
Don't click any link or open any attachment, even "just to see." Report it - most webmail providers have a "Report phishing" option in the message menu, distinct from marking it as ordinary spam, and reporting trains your provider's filters more effectively than deleting it silently. You can also forward the message to the Anti-Phishing Working Group at [email protected], which aggregates reports for its quarterly trends research, or follow the reporting steps in CISA's Recognize and Report Phishing guidance. If the email impersonates a service you actually use, log in by typing the address directly into your browser - never through the email's link - and check your account activity from there.
How to cut down on how many you get
You can't fully stop phishing emails from arriving - attackers buy scraped address lists and don't ask permission - but a few habits reduce the volume. Report messages as phishing rather than just deleting them, since that feedback improves your provider's spam model over time. Avoid posting your email address in plain text on public forums or social profiles, where scraping bots harvest it automatically. And be cautious with newsletter sign-ups on unfamiliar sites - a chunk of scraped-list phishing traces back to a data broker reselling an email address collected at signup.
How automated tools catch what a quick read misses
Reading through this checklist manually for every email you get is not realistic, which is the entire reason detection tools exist. We run 25 independent heuristic checks against every email opened in Gmail, Outlook, Yahoo Mail, and Proton Mail - covering every red flag category above, from sender mismatch to hidden CSS content - and combine the results into a single risk score from 0 to 100, with a colored badge (green, yellow, red) so you don't have to hover over every link yourself. For emails that pass the rule-based checks but still feel off, an on-device AI model provides a second opinion; our guide on AI phishing detection, on-device vs cloud explains exactly how that second layer works and why where the model runs matters for your privacy.
If you're choosing between detection approaches - manual review, browser-native warnings, or a dedicated extension - our best phishing protection comparison lines them up side by side.
Final verdict - how to spot a phishing email
Spotting a phishing email comes down to three checks, in order: sender domain, link destination, and manufactured urgency. Any one mismatch is a reason to pause; two or more is a reason to delete and report without clicking anything. Since no one has time to run that checklist manually on every email, automated heuristic and AI checks exist to do it instantly, on every message, without you having to think about it.