How to Spot a Phishing Email: 10 Signs and Real Examples

How do you spot a phishing email?

Check three things before you act: who really sent it, where the link really goes, and what it wants you to do. A phishing email usually comes from an address that doesn't match the brand, points to a look-alike website, and pushes you to log in, pay or open a file right away. If any of the three is off, don't click.

For screenshots from real brands, see our phishing email examples.

10 signs of a phishing email

1. The sender's address doesn't match the company

The display name says "Microsoft" or "PayPal," but the address behind it is a free mailbox or a domain with extra words, swapped letters or an odd ending. Tap or hover on the sender name to see the full address. A real PayPal notice comes from paypal.com, not paypal-billing-center.net.

2. The link goes somewhere else

Hover over a link (or press and hold on a phone) before you click. If the address that appears isn't the company's own domain, or it's a link shortener, treat the email as phishing. Watch the part just before .com: in microsoft.account-verify.net, the real domain is account-verify.net.

3. It asks you to log in, confirm or verify

"Verify your account," "confirm your password" and "your mailbox is almost full" are the most common phishing requests, because a stolen login is worth more than almost anything else. Real companies rarely send a link that drops you on a login page out of the blue.

4. It puts a clock on you

"Within 24 hours," "final notice," "your account will be suspended." Urgency is there to stop you from checking. The more pressure an email applies, the more time you should take.

5. It asks for money, gift cards or new bank details

Requests to pay an overdue invoice, buy gift cards for a manager, or update a vendor's bank account are classic business email compromise. Confirm any payment change by calling a number you already have, not one in the email. Our fake invoice email examples show how these read.

6. There's an attachment you didn't expect

Unexpected invoices, "scanned documents," voicemail files and shared PDFs are common carriers for malware or fake login pages. Be most careful with .html, .htm, .zip, .iso and macro-enabled Office files. Fake voicemail notifications are a common version; see real fake voicemail messages.

7. The greeting is generic

"Dear customer," "Hello valued member" or just your email address instead of your name is a sign the message went out to thousands of people. A personal greeting doesn't prove an email is safe, though: personalized phishing (spear phishing) uses your name, title and company.

8. It asks you to keep it quiet or skip the usual process

"I'm in a meeting, just handle this," "don't mention this to anyone yet," or "reply to my personal email." Anything that asks you to go around normal approvals is a red flag, even when the name at the top is your CEO's.

9. It asks you to scan a QR code

QR code phishing hides the link inside an image, so email filters and your own eyes can't read it. A QR code in an email about your password, a document or a payment should be treated the same as a suspicious link.

10. The writing is clean but something feels off

Spelling mistakes used to be the easiest tell. They aren't anymore: attackers now write with AI tools, so many phishing emails are polished. Look past the grammar to the sender, the link and the request. If the tone doesn't sound like the person or company it claims to be from, trust that instinct.

What does a phishing email look like?

Here are two phishing emails written out as they typically arrive, with the red flags in each.

Example 1: fake Microsoft 365 password expiry

Subject: Action required: Your password expires today

From: Microsoft 365 Admin <no-reply@m365-passwordcenter.com>

Message: "Your password for your work account expires in 2 hours. To keep your current password and avoid losing access to Outlook and Teams, confirm it below. Keep My Password."

Red flags:

• The sending domain isn't microsoft.com or your company's own domain.
• A two-hour deadline.
• "Keep my password" is not something Microsoft offers by email; the button leads to a copied login page.

See how real Microsoft phishing looks on our Microsoft phishing example page.

Example 2: fake PayPal payment alert

Subject: You sent a payment of $489.99 to Coinbase

From: PayPal <service@paypal-resolution-desk.com>

Message: "If you did not authorize this transaction, call PayPal Support immediately at the number below to cancel and receive a refund."

Red flags:

• The domain only contains the word PayPal; it isn't paypal.com.
• A large charge you don't recognize, designed to make you panic.
• A phone number instead of a link. This is callback phishing: the "support agent" asks for remote access or your card details.

More on this pattern: PayPal phishing example.

How to check an email you're not sure about

1. Don't click links, open attachments, scan codes or call numbers in the message.
2. Check the full sender address and hover over every link.
3. Go to the company's site yourself by typing its address or using its app, and look for the same alert there.
4. For a request from a coworker, a manager or a vendor, confirm it through a channel you already use: a phone number you have on file, Teams or Slack, or in person.
5. Still unsure? Report it. At work, use the report button in your email client or forward it to your IT or security team.

What to do if you clicked a phishing link

Act fast and don't be embarrassed: reporting quickly matters more than the click itself.

• If you entered a password, change it right away from a device and browser you trust, and change it anywhere else you used it.
• Turn on multi-factor authentication for that account if it isn't already on.
• If you downloaded or opened a file, disconnect from the network and tell IT before you keep working.
• If you shared card or bank details, or sent money, call your bank using the number on your card.
• Tell your IT or security team what you clicked and when, even if nothing seemed to happen.

How to report a phishing email

At work, report it with your email client's report button or your company's reporting address, so your security team can pull the same message out of other inboxes. At home, use your email provider's "Report phishing" option, forward the message to the Anti-Phishing Working Group at reportphishing@apwg.org, and report fraud to the FTC at ReportFraud.ftc.gov. Then delete it.

Organizations that run phishing simulations give employees regular, safe practice spotting these red flags, and the habit that matters most is reporting.

More phishing examples

• Real phishing email examples: screenshots from Microsoft, Amazon, PayPal, Apple and more, with the red flags marked.
• 8 examples of email phishing scams: the common patterns and how to recognize each.
• Fake package delivery texts: USPS, UPS, FedEx and Amazon scam texts written out.
• Spam vs. phishing: how to tell an annoying email from a dangerous one.

Frequently asked questions

What are the most common signs of a phishing email?

A sender address that doesn't match the company, a link that goes to a different domain, urgent pressure to act, and a request for a login, payment or personal information. Unexpected attachments and QR codes are close behind.

Can a phishing email come from a real address?

Yes. If a coworker's or vendor's mailbox has been taken over, phishing can come from their real address. That's why the request matters as much as the sender: confirm any unusual ask for money, logins or files through a separate channel.

Is it safe to open a phishing email?

Opening one is usually low risk. The danger is in clicking links, opening attachments, scanning QR codes, calling the number or replying. Don't reply or click "unsubscribe," since either confirms your address is active.

Do phishing emails still have spelling mistakes?

Fewer than they used to. Attackers now use AI writing tools, so a clean, well-written email can still be phishing. Judge the sender, the link and the request instead of the grammar.