How to spot a phishing e-mail: the key warning signs

Your parcel is stuck at customs, your bank account is about to be locked, your boss urgently needs gift cards: phishing e-mails always tell a story that is meant to make you click fast. The good news is that almost every one of them leaves traces. Once you know where to look, you can spot most fakes in a few seconds.

Why phishing works so well

Phishing does not target your computer, it targets you. The messages pull three proven levers: time pressure ("within 24 hours"), authority (your bank, the tax office, your manager) and curiosity ("you have received a voice message"). People under pressure check less. That is exactly why it pays to pause for a moment whenever an e-mail demands immediate action.

Now that text can be written with AI, clumsy translations and typos are no longer a reliable sign. Focus on the things that are hard to fake instead.

Warning sign 1: the sender

Your mail app usually shows only the display name, such as "Bank Customer Service". Anyone can choose that name freely. What matters is the address behind it. Tap or click the name to see it.

Typical tricks:

• A foreign domain: [email protected] has nothing to do with your bank.
• Lookalike spelling: paypa1.example instead of paypal.example, rn instead of m, extra hyphens.
• Free mailboxes: a company does not write to you from a Gmail or Outlook.com address.
• A different reply address: if the header contains a Reply-To with a completely different address, your reply goes to the scammer.

Warning sign 2: pressure and threats

Real companies do not announce account closures with a deadline of a few hours, and no tax office asks for payment through a link. Phrases like "final notice", "your account has been limited" or "confirm immediately" are a signal to slow down, not to hurry.

The so-called CEO fraud is especially sneaky: an e-mail that seems to come from senior management asks for an urgent, confidential bank transfer. Only one thing helps here: check through a second channel, for example by phone on a number you already know.

Warning sign 3: links that lead somewhere else

The visible link text can claim anything. To see where a link really goes, hover over it with the mouse without clicking. On a phone, press and hold the link.

Read the domain from right to left. With https://example.com.account-check.net/login the site belongs to account-check.net, not to example.com. Everything to the left of it is just a subdomain the owner can make up.

Be careful with short links and QR codes in e-mails, too: they hide the destination. When in doubt, open the company's site yourself by typing the address or using a bookmark.

Warning sign 4: attachments

Unexpected invoices, delivery notes or "scanned documents" are a classic. The most dangerous ones are:

• HTML files that open a copied sign-in page in your browser
• Archives such as .zip, .rar or .iso that contain malware
• Office documents that ask you to "enable content" or allow macros

Only open an attachment if you expected it and the sender checks out.

Warning sign 5: what a real company never asks for

Legitimate providers never ask you by e-mail for your password, your PIN, a transaction code or a confirmation code you have just received by text message. Whoever asks for such a code wants to sign in to your account.

Check the header

The header of an e-mail shows which servers it passed through and whether it passed the SPF, DKIM and DMARC checks. If it says dmarc=fail for a domain pretending to be your bank, the case is clear. Our guide How to read e-mail headers explains how to find and read it.

One limitation is important: a passing SPF or DKIM result only proves that the message really comes from the domain it names. A scammer can set everything up correctly for their own domain account-check.net as well. The checks tell you who wrote, not whether you can trust that sender.

If you have already clicked

What's done is done; now speed matters:

1. Change your password directly on the real site of the service, not through the link. If you used the same password elsewhere, change it there as well.
2. Turn on two-factor sign-in if you have not already.
3. Contact your bank if you entered payment details. Use the number on your card or the official website.
4. Check your device if you opened an attachment, for example with an up-to-date virus scanner.
5. Keep an eye on your accounts and end suspicious sessions in the security settings of your accounts.

Report phishing

Most mail apps have a "Report phishing" button. It trains the filter and warns other users. Many companies also accept forged e-mails sent in their name through a dedicated reporting address that you can find on their website.

Prevent it with separate addresses

The fewer places know your main address, the less phishing reaches it. If you use a disposable address for giveaways, downloads and forums, scammers often never learn your real address in the first place. And a supposed e-mail from your bank to an address you only used for a forum gives itself away.

Check the header of a suspicious e-mail with the header analyzer – free and without signing up.