How do you spot a phishing email, with examples?
To spot a phishing email, check the real sender address, not just the display name, and see where a link really goes before you click. Typical examples are a fake delivery fee, a warning that your account is locked, or a boss asking for gift cards. If in doubt, contact the sender through a channel you already trust.
▶ Try it
Why it matters
Most breaches start with a message that creates urgency or borrows authority. Learners practise reading the signals: an odd sender, a mismatched link, time pressure, and requests for credentials or money.
In 9 minutes you'll be able to
- Look at the real sender address and where the link really goes.
- Urgency, authority, money, gift cards and codes are the classic tricks.
- Clicked? Report it immediately. Speed matters more than embarrassment.
What you'll practise
The 5 red flags
Almost every phishing message uses at least one of these tricks.
- ⏰ Urgency or fear
- "Your account will be locked in 24 hours." Pressure stops you from thinking.
- 🎭 Borrowed authority
- It looks like it's from your boss, your bank or IT. Check the real sender address, not the display name.
- 🔗 Links that don't match
- The text says one thing, the link goes somewhere else. Hover or long-press before you click.
- 📎 Unexpected logins or files
- A surprise attachment or a login page you didn't ask for is a classic trap.
- 🎁 Money, gift cards, codes
- Requests for payments, gift cards or one-time codes are almost always a scam.
Phish or legit?
Open each email. Inspect the sender and links, then decide.
Smishing: the "Hi Mum" text
Phishing also comes by text message. Tap every red flag in this SMS.
Unknown number
Hi Mum, this is my new number, my phone broke. Can you pay a bill for me urgently? I can't call right now. Please don't tell Dad. Love you ❤️Clicked it? Do this
It happens to everyone. You clicked a phishing link and typed your password. Put the steps in order.
- Stop: don't enter anything else or open more files
- Report it to IT or security straight away
- Change the password from a different, safe device
- Turn on MFA for that account if it isn't already
- Watch for strange activity and warn colleagues who got the same email
Remember
Pressure is the tell. Slow down and check the real sender and the real link.
Pressure is the tell. Slow down and verify through a channel you already trust.
Key facts
- 68% of breaches involved a non-malicious human element, such as falling for a social engineering attack or making an error. · Source: Verizon Data Breach Investigations Report 2024
- Phishing was the most reported type of cybercrime to the FBI in 2023, with almost 300,000 complaints. · Source: FBI IC3, Internet Crime Report 2023
- Business email compromise, where criminals pose as a boss or supplier to redirect payments, led to about $2.9 billion in reported losses in 2023. · Source: FBI IC3, Internet Crime Report 2023
- Phishing also arrives by text message (smishing) and phone call (vishing), with the same tricks: urgency, borrowed authority and a request to act now.
Updated:
Questions people ask
What are the signs of a phishing email?
A sender address that doesn't match the organisation, links that lead to a different site, urgency or threats, unexpected attachments or login pages, and requests for money, gift cards or codes.
What should I do if I clicked a phishing link?
Stop entering anything, report it to your IT or security team straight away, and change the password from a different device. Then turn on MFA and watch the account for strange activity.
What is smishing?
Smishing is phishing by text message. Common examples are fake parcel-delivery fees and "Hi Mum, this is my new number" messages asking for an urgent payment.
How do I report a phishing email?
At work, use the report button or forward it to your IT or security team. In personal email, use the "Report phishing" or "Report spam" option, then delete it without clicking any links.
Related terms