A phishing email tries to persuade you to reveal information, open a harmful file or take an action that benefits a criminal.
These emails may pretend to come from your bank, hosting provider, delivery company or a colleague. Some contain obvious mistakes; others look convincing.
The safest approach is to verify unexpected requests through a separate, trusted route.
Check the Full Sender Address
A familiar display name does not prove who sent a message.
Expand the sender details and examine the complete email address. Look for misspelled domains or addresses unrelated to the organization being represented.
Even a familiar address is not a guarantee: a legitimate account could have been compromised.
Be Cautious With Urgent Requests
Phishing messages often pressure you to act immediately.
Common examples include:
- “Your account will be suspended.”
- “Your payment failed.”
- “Confirm your password now.”
- “Pay this invoice today.”
Urgency alone does not prove a message is fraudulent. It is a reason to pause and verify the request before acting.
Open Your Account Separately
If an email claims there is a problem with your account, open the official app or use a saved bookmark.
Check for notifications, unpaid invoices or security warnings there. If you need assistance, use contact information from the official website rather than the suspicious email.
Inspect Links Carefully
On a computer, hovering over a link can reveal its destination. On a phone, you may be able to preview a link by pressing and holding it.
Watch for misspelled addresses, unrelated domains and misleading subdomains. A padlock or HTTPS connection does not establish that a website is trustworthy.
When uncertain, avoid the link and navigate to the service independently.
Treat Unexpected Attachments Carefully
Be cautious with files you were not expecting, even when they appear to come from someone you know.
If a document asks you to enable macros, install software or bypass a security warning, stop and verify the request.
Contact the sender using a phone number or conversation you already trust.
Never Share Verification Codes
Someone requesting your password, recovery codes or sign-in verification codes may be trying to take over your account.
Do not share these details with someone who contacts you unexpectedly. Enter codes only into the legitimate service when completing an action you initiated.
Verify Changes to Payment Details
For freelancers and business owners, a convincing invoice can be especially risky.
If someone asks you to pay into a new bank account, confirm the change through an established contact method. Do not rely solely on a reply within the same email conversation.
What If You Already Clicked?
Your next step depends on what happened:
You opened a page but entered nothing: Close it. Check whether anything downloaded, and keep your browser and device updated.
You entered a password: Open the genuine service separately, change the password and review active sessions, recovery settings and multifactor authentication. Change it elsewhere if you reused it.
You downloaded or opened a suspicious file: Stop interacting with it. Run your device’s security checks and seek trusted technical help if needed.
You shared payment information or sent money: Contact your bank or payment provider promptly using an official contact method.
You used a work device or account: Notify your organization’s IT or security contact immediately.
Report the Message
Use your email provider’s phishing-reporting option. Reporting helps the provider investigate the message.
If it impersonates an organization, you can also report it through that organization’s official reporting channel.
Make Verification a Habit
You do not need to prove that every suspicious email is fraudulent. If a request is unexpected, verify it before clicking, downloading or paying.
A short pause can help prevent a costly mistake.
