How to Spot a Phishing Email: 7 Signs and What to Do

Rootlet

Wed, 04 Nov 2026

A phishing email is a message that pretends to come from someone you trust, such as your bank, a delivery company, a colleague or a supplier, so that you click a link, open a file, hand over a password or send money. Spotting one comes down to a short set of checks you can run in under a minute, plus one habit: never act on the email itself until you have checked it another way. This guide walks through each check with examples, shows you how to read a web address so you can see who really owns it, and explains what to do and where to report in the UK, including what to do if you have already clicked.

The short answer

• Check the real sender address, not just the name shown at the top.
• Be wary of pressure: deadlines, threats, panic, or an offer that seems too good to miss.
• Look before you click: hover over a link, or press and hold it on a phone, and read where it really goes.
• Treat requests for passwords, codes, card details or payments as a red flag, along with unexpected attachments.
• If in doubt, contact the organisation yourself using details you already know are genuine, never the ones in the email.
• Report it by forwarding it to report@phishing.gov.uk, then delete it.

Seven signs of a phishing email

No single sign proves an email is fake, and some scams are very polished. The point is to check the same things every time, so that something odd stands out. The UK government's Stop! Think Fraud campaign and the National Cyber Security Centre (NCSC) both describe these warning signs in their own guidance.

1. The sender's address doesn't match

The name you see at the top of an email, called the display name, can be set to anything. "Brightwater Bank" on its own means nothing. Click or tap the name to reveal the full address behind it, and look at the part after the @ sign, called the domain. Is it the organisation's real domain, or something close but wrong, such as brightwater-bank-alerts.com, or a free webmail address?

2. A greeting that doesn't use your name

"Dear Customer", "Dear Valued Member" or just your email address can be a warning sign, because organisations you have an account with usually know your name. The reverse isn't true, though: criminals sometimes have your name from a data breach, so a personal greeting doesn't make an email safe.

3. Pressure: urgency, fear, authority or a tempting offer

Phishing works by rushing you past the moment where you would stop and think. The NCSC's guidance on how to spot a scam email, text message or call lists the tricks to watch for:

• Authority: the message claims to be from someone official, such as a bank, a government department or your boss.
• Urgency: you're told to respond "within 24 hours" or "immediately", or your account will be closed.
• Emotion: the message tries to make you panic, or makes you fearful, hopeful or curious.
• Scarcity: it offers something in short supply, such as tickets or money.
• Current events: it matches something you might be expecting, such as a parcel, a tax bill or a news story.

If you notice a strong feeling of "I need to sort this right now", treat that feeling itself as a reason to slow down.

4. A link that goes somewhere unexpected

The words you click and the place they take you can be completely different. A button saying "Log in to your account" can lead anywhere, and so can a link whose text looks like a real web address. To see the real destination without opening it:

• On a computer: rest your mouse pointer over the link without clicking (hovering). The real address appears, usually in the bottom corner of the window.
• On a phone or tablet: press and hold the link instead of tapping it. You'll see a preview of the address. If it looks wrong, close the preview without opening or copying it.

Seeing the address is only half the job. The next section shows you how to read it.

5. An attachment you weren't expecting

Unexpected invoices, "voicemail" files, delivery notes and "documents to sign" are common ways to deliver harmful software. Ask yourself one question first: was I expecting this file from this person? If not, check with them by another route before opening it. Take extra care with:

• programs and scripts, such as files ending .exe, .msi, .scr, .bat, .js or .vbs, which you should almost never receive by email
• compressed or disk files, such as .zip, .rar or .iso, which can hide a harmful file inside
• documents that ask you to "Enable content" or "Enable editing" before you can read them
• double extensions, such as invoice.pdf.exe, where the real file type is the last one (so this is a program, not a PDF)

6. A request for details, codes or money

Be very wary of any email asking for your password, PIN, full card number, a security code sent to your phone, or a payment to new bank details. The NCSC says genuine organisations, including banks, won't ask for personal information by email. A request to "sign in to view a document" deserves the same suspicion: a fake sign-in page is a common way to steal email passwords, and once someone has your email, they can reset many of your other accounts.

7. It looks familiar but not quite right

Stop! Think Fraud's guide to how to spot a phishing email mentions logos and design that look familiar but don't feel quite right, and spelling and grammar mistakes. Both are worth noticing, but don't rely on them. Plenty of phishing emails are now well written and well designed, so a clean, professional email can still be a fake. The other six checks work whether the writing is good or bad.

How to read a web address

Criminals rely on you reading the start of an address and assuming the rest is fine. To find out who really owns a site:

1. Ignore the "https://" at the beginning.
2. Find the first single forward slash (/) after that. Everything after it is just a page on the site and can say anything.
3. Look at the part before that slash and read it from the right-hand end. The owner is the word just before the ending, such as .com, .org or .co.uk.

Here's how that works on four addresses for a made-up bank whose real domain is brightwaterbank.co.uk:

Two more points. A padlock symbol or "https" only means the connection is encrypted. It says nothing about who owns the site, and fake sites can have a padlock too. And shortened links hide their destination completely. For anything important, the safest option is to skip the link altogether: type the organisation's address yourself, use a bookmark you saved earlier, or open its official app. If the email was genuine, whatever it mentioned will be waiting for you when you log in the normal way.

A worked example: the parcel email

This example is made up, but it follows a familiar pattern.

Running the checks:

• Sender: the domain is swiftparcel-redelivery.info. An extra made-up word and an unusual ending are big warning signs.
• Greeting: "Dear Customer". The email doesn't know who you are.
• Pressure: 24 hours, or the parcel goes back.
• Request: a small payment. It's small on purpose, so it feels too minor to worry about. The real aim is usually your full card details, which can then be used for much bigger payments.

Four signs is plenty. You don't need to hover over the button to decide. If you are expecting a parcel, open the delivery company's app or type its web address yourself, and use the tracking number from the shop you bought from.

When a phishing email looks perfect

Some phishing passes almost every check. Criminals sometimes break into a real person's or supplier's email account and send messages from it to everyone in its contacts. In that case the sender address is genuine, the greeting uses your name and the tone sounds right.

What gives these emails away is usually the request. Watch for:

• a shared document that asks you to sign in with your email password to view it
• a supplier or contractor saying their bank details have changed and the next invoice should go to a new account
• a "boss" or senior colleague asking for an urgent payment or gift cards and saying they can't talk on the phone right now

The fix is the same every time: check with the person using a phone number or address you already have, not by replying to the email. If it was genuine, they won't mind. If it wasn't, you may also be warning them that their account has been taken over.

What to do with a suspicious email

1. Don't engage. Don't reply, click links, open attachments, call numbers in the email or pay anything.
2. Check it another way if it might be real. Contact the organisation using details you already know are correct, such as the number on the back of your card, on a bill or statement, or on its official website. For your bank, you can also call 159.
3. Report it. Forward the email to report@phishing.gov.uk before you delete it.
4. Delete it, or use the report or junk button in your email app as well.
5. At work, tell your IT contact or manager and follow your workplace's own reporting process.

The NCSC's page on reporting a scam email explains what happens next: it analyses the email and any sites it links to, and can work with hosting companies to have malicious sites removed. It can't tell you the outcome of each report, and you can forward as many suspicious emails as you like.

If you've already clicked

It happens, especially when you're tired, busy or expecting the very thing the email mentions. What matters is acting quickly and calmly. First, work out exactly what you did, then follow the steps that match.

You only opened the link

Close the page without entering anything. Run a scan with your security software, such as the protection built into your computer, to be on the safe side.

You typed in a password

• Go to the real website or app yourself (not through the link) and change the password.
• If you used the same password anywhere else, change it there too, starting with your email account.
• Turn on 2-step verification if it isn't already on.
• Look for an option to sign out of all other sessions or devices.
• Check your recovery email, recovery phone number and email forwarding settings for anything you didn't set up.

You gave card or bank details, or sent money

Contact your bank straight away on a number you trust, such as the one on the back of your card or in its official app, or call 159. Never use a number from the email. Tell them exactly what happened. Then report the fraud (see below) and keep an eye on your statements over the following weeks.

You opened an attachment or installed something

Disconnect the device from the internet by turning off Wi-Fi or unplugging the cable, then run a full scan with your security software. If anything still seems wrong, get help from a trusted IT person. At work, tell your IT contact straight away.

Where to report in the UK

You can report a suspicious email even if you didn't click it. GOV.UK's page on reporting suspicious emails, websites and text messages sets out the main routes, and the NCSC and Stop! Think Fraud give the fraud reporting routes for each part of the UK.

Before you report fraud, gather what you can: what happened and when, any amounts and how you paid, the email address or web address involved, and screenshots. Keep the original email until you've reported it.

If you'd like to build these checks into habits, our Cyber Security Basics course covers phishing emails, scam texts and calls, checking links and attachments, and what to do if you click, then goes on to passwords and 2-step verification, securing your devices and home Wi-Fi, backups, privacy, invoice fraud at work and reporting cybercrime in the UK. It's 55 written lessons across 10 sections, with a practice pack of worksheets and checklists in every section, and no technical knowledge is needed to start.