Phishing emails are designed to look convincing and get you to act before you have time to question the request. Some are obvious, while others may come from familiar companies, people you know, or even a legitimate account that has been compromised.
One red flag doesn't always mean an email is phishing. But when something feels unexpected, unusual, or out of place, pause and take a closer look.
Check the Sender
Don't rely on the display name alone. Look at the actual email address and ask:
- Does the domain match the company or person?
- Is anything misspelled or slightly different? (realrernaxgroup.com vs realremaxgroup.com) - do you spot it?
- Is this the address this person normally uses?
- Is it unusual that they're contacting you from this account?
Example:
Domain Impersionation: (realrernaxgroup.com vs realremaxgroup.com) - do you spot it?
Display Name Red Flag: Amazon Support (support@amaz0n-help.com) may display a familiar name, but the address/domain tells a different story.
Check out some additional red flags with this common phish example:
Check the Request
Ask yourself: Does this make sense?
Be cautious of unexpected requests to:
- Reset or verify a password
- Sign in to view a document
- Send money or purchase gift cards
- Change banking or payment information
- Share personal or financial information
- Provide a password or verification code
- Download or open an unexpected attachment
- Bypass a normal process
Even if you recognize the sender, an unusual request is worth verifying.
Watch for Urgency and Emotion
Phishing often tries to create a reason for you to act quickly.
Watch for messages that create:
- Urgency: “Your account will be disabled today.”
- Fear: “Suspicious activity was detected.”
- Curiosity: “Someone shared a confidential document with you.”
- Excitement: “You've won a prize!”
- Pressure: “I need this completed immediately.”
- Secrecy: “Don't tell anyone about this yet.”
The goal is often the same: get you to react before you stop and think.
Check Links Before You Click
The words displayed in an email don't necessarily tell you where a link will actually take you.
When possible:
- Hover over a link to preview the destination.
- Look closely at the website domain.
- Don't assume a link is safe because it includes a familiar company's name.
- If you're unsure, open your browser and navigate to the company's website yourself.
For example, instead of clicking an unexpected “Microsoft password reset” link, go directly to the Microsoft account website through your normal method.
Be Careful with Attachments
Treat unexpected attachments with caution, particularly when the message is asking you to open something you weren't expecting.
Be cautious of unexpected:
- Invoices
- Receipts
- PDFs or Office documents
- ZIP files
- Shared documents
- Voicemails or fax notifications
If you know the sender but weren't expecting the file, verify with them another way before opening it.
Don't Let Familiarity Lower Your Guard
A real email address can still send a bad email. If someone's account has been compromised, an attacker may be able to send messages from their actual address, and in some cases use existing conversations to make the request seem more believable.
That's why the question isn't only:
“Do I recognize the sender?”
It's also:
“Does this request make sense coming from this person?”
When Something Doesn't Feel Right
Pause. Verify. Then act.
Don't use the phone number, link, or contact information provided in a suspicious message to verify the message itself.
Instead:
- Contact the person using information you already have.
- Visit the company's website directly.
- Open the company's official app.
- Check your account independently for the alert or notification.
Remember
Phishing doesn't always look like phishing.
A professional logo, correct spelling, familiar sender, legitimate service, or real email address isn't proof that a message is safe.
Slow down, look at the request, and verify when something doesn't add up.