To spot a phishing email, look for urgency or threats, a sender address that doesn't match the company, links whose real address differs from the text, unexpected attachments, requests for passwords, codes or payment, and generic greetings.
To spot a phishing email, look for urgency or threats, a sender address that doesn't match the company, links whose real address differs from the text, unexpected attachments, requests for passwords, codes or payment, and generic greetings. If in doubt, don't click: go to the company's website or app yourself. In the UK, forward suspicious emails to report@phishing.gov.uk.
Phishing is a scam where criminals pretend to be a trusted organisation, such as your bank, a delivery firm, HMRC, the IRS, Netflix or your employer, to trick you into handing over details, money or access. It's the most common way online accounts and company networks get compromised.
Scam emails are now much better written than they used to be, so spelling mistakes are no longer a reliable tell. This guide gives you the checks that still work, how to inspect links and sender details safely, and exactly what to do if you've already clicked.
In this guide:
| # | Warning sign | Example |
|---|---|---|
| 1 | Urgency or a deadline | "Your account will be closed in 24 hours" |
| 2 | Threats or fear | "Unusual sign-in detected, verify now or lose access" |
| 3 | Too good to be true | "You've won a £500 voucher" or "Claim your tax refund" |
| 4 | Sender address doesn't match | "Royal Mail" from parcel-update@rm-redelivery.info |
| 5 | Link goes somewhere unexpected | Text says paypal.com, link goes to paypal.account-check.co |
| 6 | Asks for passwords, codes or PINs | "Reply with the code we sent to confirm" |
| 7 | Unexpected attachment | "Invoice_8821.zip", .html or .iso files, or Office files asking you to "enable content" |
| 8 | Generic greeting | "Dear customer" from a company that knows your name |
| 9 | Unusual payment request | Gift cards, crypto, or "new bank details" for a supplier |
| 10 | Request for secrecy | "Keep this confidential, I'm in a meeting" from "the boss" |
| 11 | Doesn't fit your situation | A delivery notice when you haven't ordered anything |
| 12 | QR code instead of a link | "Scan to re-verify your mailbox", a trick to dodge email filters |
One sign on its own doesn't prove an email is a scam, as genuine companies do send urgent messages. But two or three together should make you stop and check another way.
You never need to work out for certain whether an email is fake. Instead, don't use anything in the email, whether a link, phone number or attachment. Go to the organisation directly:
If the message was genuine, the same alert will be waiting in your account. If it wasn't, you've lost nothing.
| Device | How to see the real link |
|---|---|
| Windows or Mac (desktop email, webmail) | Hover over the link; the real address appears at the bottom of the window or in a tooltip |
| iPhone or iPad | Press and hold the link; a preview shows the address. Don't tap Open |
| Android | Press and hold the link to see or copy the address |
| Outlook desktop | Hover; the tooltip shows the real URL, sometimes wrapped by Safe Links |
Then read the address carefully. The part that matters is the domain just before the first single slash:
| Address | Real domain | Safe? |
|---|---|---|
| https://www.paypal.com/signin | paypal.com | Genuine |
| https://paypal.com.secure-login.net/signin | secure-login.net | Fake: the real domain is at the end |
| https://paypa1.com/signin | paypa1.com | Fake: number 1 instead of letter l |
| https://www.hmrc-refund.uk/claim | hmrc-refund.uk | Fake: HMRC uses gov.uk |
| https://bit.ly/3xYz | Shortened, hidden | Treat with suspicion |
Scam links often contain long encoded strings to hide where they lead. Our URL decoder turns those %-encoded characters back into readable text, so you can paste a copied link there and see it without visiting it.
The name you see ("Amazon", "Barclays") can be set to anything. Check the actual address:
Things to look for:
| Check | Suspicious if… |
|---|---|
| Domain after the @ | It's a free webmail address or a lookalike (amaz0n-support.com) |
| Reply-To | Replies go to a different address from the sender |
| Authentication results (in headers) | SPF, DKIM or DMARC show "fail" |
| Mail client warning | A banner says "This message might be dangerous" or it came from outside your organisation |
A correct sender address doesn't guarantee safety: accounts get hacked, and messages can be sent from compromised genuine mailboxes. That's why the golden rule above still applies.
| Scam | Typical lure | Reality check |
|---|---|---|
| Parcel delivery | Royal Mail, Evri, DPD, USPS or UPS asks for a small "redelivery fee" | Check tracking on the courier's own site |
| Tax refund | HMRC or IRS says you're owed money | HMRC and the IRS don't email about refunds with links to claim them |
| Bank security alert | "Suspicious payment, verify your details" | Open your banking app instead |
| Streaming or subscription | Netflix, Amazon Prime or Apple says payment failed | Check in the app or account page |
| Microsoft 365 or Google login | "Your mailbox is full" or "shared document" | Sign in by typing the address yourself |
| CEO or invoice fraud | "Pay this supplier today" or "change bank details" | Confirm by phone with a known contact |
| Fake breach alert | "Your account was in a breach, click to secure it" | Use a trusted breach checker directly |
| AI-written and voice scams | Polished emails followed by a call that sounds like someone you know | Agree a family or team code word |
Breach-themed lures are common because real breaches make the news. Our guide on how to check if your email was breached shows the safe way to check.
The NCSC runs the Suspicious Email Reporting Service. Its guide to reporting scam emails explains the process:
| What happened | Where to report |
|---|---|
| Received a phishing email | Forward to reportphishing@apwg.org and use your email provider's "Report phishing" option |
| Received a scam text | Forward to 7726 (SPAM) |
| Lost money or shared information | ReportFraud.ftc.gov |
| Identity theft | IdentityTheft.gov |
| Internet crime with losses | The FBI's Internet Crime Complaint Center (IC3) |
| Email pretending to be the IRS | Forward to phishing@irs.gov |
After reporting, delete the email. Reporting through your mail app also helps train its filters.
Act quickly but calmly. The steps depend on what you did:
| What you did | What to do now |
|---|---|
| Clicked but entered nothing | Close the page. Run your security software's scan. Usually low risk |
| Entered a password | Change it immediately on the real site, plus anywhere you reused it; turn on 2FA |
| Entered a 2FA code | Change your password, sign out all other sessions, review recovery details |
| Entered card or bank details | Call your bank on the number on your card now |
| Opened an attachment or "enabled content" | Disconnect from the internet, run a full scan; at work, call IT straight away |
| Sent money | Contact your bank immediately, then report the fraud (Action Fraud, Police Scotland or the FTC) |
At work, tell your IT or security team even if you're embarrassed. Early reports stop attacks spreading, and good teams thank people for them.
Phishing is harder to spot on a phone because small screens hide sender addresses and full links. Take a moment to tap the sender's name to see the real address, press and hold links rather than tapping them, and be especially careful with messages that arrive by text, WhatsApp or social media direct message, which skip email filters. If a message asks you to call a number, look the number up on the company's official website instead.
Look for urgency, threats, a sender address that does not match the company, links that go somewhere unexpected, unexpected attachments, and requests for passwords, codes or payment. If in doubt, contact the company through its official website or app.
Forward them to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service. Forward scam texts to 7726. If you have lost money, contact your bank and report to Action Fraud or Police Scotland.
Forward phishing emails to reportphishing@apwg.org and report through your email provider. If you lost money or information, report it at ReportFraud.ftc.gov. Forward scam texts to 7726.
Opening an email is usually low risk with an up-to-date mail app. The danger comes from clicking links, opening attachments, enabling content or replying with information.
If you entered nothing, close the page and run a security scan. If you entered a password, change it on the real site and anywhere you reused it, and turn on 2FA. If you shared bank details, call your bank immediately.
Yes. Criminals can send from hacked genuine accounts, or use lookalike domains. A correct-looking sender does not guarantee an email is safe, so verify unusual requests another way.
They can, but many scam emails are now well written, sometimes using AI. Focus on what the email asks you to do and whether it fits your situation, rather than on grammar.
Phishing is done by email, smishing by text message and vishing by voice call. They use the same tricks, and the same rule applies: verify through a route you trust.
Last checked: 20 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.
To check Windows Firewall status, open Windows Security and select Firewall & network protection. Each profile (Domain, Private, Public) says whether the firewall is on, and the one you're using is marked active. netsh and PowerShell give the same answer in one line.
To check BitLocker status, search Start for Manage BitLocker, or run manage-bde -status in an admin Command Prompt. Look at Protection Status: Protection On means your drive is really protected. Fully Encrypted with Protection Off means it isn't, yet.
Step-by-step Windows security guides: check Defender, startup programs, failed logins, open ports, UAC, encryption, passwords and 2FA. Plain English, free tools.
Check if Microsoft Defender Antivirus is on, up to date and not in passive mode. Windows Security steps, Get-MpComputerStatus fields, tamper protection and fixes.