A phishing email is a message designed to trick you into doing something that helps an attacker: entering a password on a fake page, opening a malicious file, paying a fake invoice or revealing personal details. It is the most common way accounts are taken over and the usual first step of larger attacks on companies. Phishing messages have become more convincing, often copying a real brand's layout and tone, so spotting them is a skill worth learning. This guide explains what a phishing email is, the main types, the warning signs, how to check a suspicious message safely, what to do if you already clicked or opened an attachment and how organisations can reduce the risk. For reporting, see our companion guide on how to report a phishing email.
What is a phishing email?
The word comes from "fishing": attackers cast many lures and wait for someone to bite. A phishing email pretends to come from a trusted party, such as a bank, a delivery company, a colleague, a government office or a service you use, and asks you to take an action. The action is usually to click a link, open an attachment, reply with information or call a number. Phishing differs from ordinary spam, which is unwanted advertising: phishing is deception aimed at theft or fraud. For how filters treat unwanted mail in general, see how to test if your email will go to spam.
Types of phishing
| Type | How it works | Example |
|---|---|---|
| Bulk phishing | The same message is sent to a very large number of people | "Your account is locked, verify now" |
| Spear phishing | A message tailored to one person or company using researched details | A note that mentions your manager's name and a real project |
| Business email compromise | An attacker impersonates an executive or supplier to request a payment or a change of bank details | "Please pay this invoice today and keep it confidential" |
| Credential phishing | A fake sign-in page collects your password | A link to a copy of a login page |
| Malware attachment | A file that installs harmful software when opened | "Invoice.zip" or a document asking you to enable content |
| Smishing and vishing | The same lure by text message or phone call, often combined with an email | "Call this number to dispute a charge" |
| QR code phishing | A QR code in the message leads to a fake page | "Scan to confirm your delivery" |
How to spot a phishing email: the warning signs
1. The sender does not match
Look at the full address, not only the display name. A message from "Your Bank" may come from an unrelated domain, or from a domain that differs from the real one by a letter or a hyphen. On a phone, tap the sender name to see the address. Remember that the visible name is easy to fake. Even a perfect-looking address is not proof, because attackers can sometimes spoof the sender or take over a real account. Authentication checks help your mailbox provider spot forgeries; see email authentication explained.
2. Urgency, fear or too-good-to-be-true offers
"Your account will be closed in 24 hours", "unusual sign-in detected", "you have won", "payment overdue". Pressure is designed to stop you from thinking. Legitimate organisations rarely threaten immediate loss through an email link.
3. Links that do not go where they claim
Hover over a link on a computer, or press and hold on a phone, to see the real destination. Be wary of shortened links, of addresses that contain the brand name but belong to a different domain, such as brandname.example-login.com, and of pages that ask you to sign in after arriving from an email.
4. Unexpected attachments or requests to enable macros
Be careful with compressed archives, executable files, documents that ask you to enable editing or content, and PDFs that open a link. An invoice you were not expecting is a classic lure.
5. Generic greetings or odd wording
"Dear customer" instead of your name, strange phrasing and layout flaws can be clues, though modern attacks, sometimes written with the help of automated tools, can be well written. Do not rely on poor spelling as the only signal.
6. Requests for sensitive information or unusual actions
Banks and reputable services do not ask for your full password, one-time codes or card PIN by email. A request to buy gift cards, change payment details or keep something secret is a red flag.
7. Context that does not fit
A message about a parcel when you ordered nothing, a request from a colleague that is out of character or an email at an odd time deserves a second look.
How to check a suspicious email safely
- Do not click or reply. Replying confirms your address is active.
- Check the sender address and the link destination without opening them.
- Go to the source yourself. Type the website address in your browser or use the official app, and see whether the same notice appears in your account.
- Call a known number. For payment requests, use a number you already have, not one from the message.
- Look at the headers if you want to dig deeper; see how to read email headers.
- Ask the IT team if the message arrived at work, and report it.
What to do if you opened or clicked a phishing email
Opening a message is usually harmless on its own, though some mail apps load remote content when you open it. The risk comes from what you do next. The steps depend on what happened.
- You only opened it. Close it, do not click anything and delete or report it. Make sure your device and mail app are up to date.
- You clicked a link but entered nothing. Close the page. Run a security scan on the device if you are unsure, and watch for odd behaviour.
- You entered a password. Change that password at once from a trusted device, and change it anywhere else you reused it. Turn on multi-factor authentication. Review recent account activity, sign out other sessions and check mailbox rules, forwarding settings and recovery details, since attackers often add a hidden forwarding rule.
- You entered card or bank details. Contact your bank immediately using the number on your card, and ask to block or replace the card.
- You opened an attachment. Disconnect the device from the network, run a full scan with up-to-date security software and tell your IT team if it is a work device. They may need to reset credentials and check other systems.
- You sent money. Contact your bank at once, since a fast request to recall a payment sometimes succeeds, and report the fraud to the relevant authorities.
How organisations reduce phishing risk
- Authenticate your own domain with SPF, DKIM and DMARC and move toward an enforcing policy, so attackers cannot easily forge your brand. See moving DMARC to reject.
- Use multi-factor authentication on every account, preferably methods that resist phishing.
- Train staff with realistic examples and make reporting easy and blame-free.
- Require a second check for payment changes.
- Keep software updated and filter attachments.
- Monitor for lookalike domains that imitate yours.
Senders also have a duty not to look like phishers. Legitimate bulk email should use your own authenticated domain, clear sender names, links that match your brand and an honest unsubscribe path; see how content affects spam filters.
Make it harder to fake your brand Check that your domain has SPF, DKIM and DMARC set correctly so forged messages are easier to reject.
References and further reading
Frequently asked questions
What is a phishing email?
A deceptive message that pretends to come from a trusted party and tries to get you to click a link, open a file, send money or reveal information.
How can you spot a phishing email?
Check for a mismatched sender address, urgency or threats, links whose real destination differs, unexpected attachments, generic greetings and requests for sensitive information.
What should I do if I opened a phishing email?
If you only opened it, close it and delete or report it. If you clicked and entered details, change passwords, enable multi-factor authentication and contact your bank or IT team as needed.
What is the difference between spam and phishing?
Spam is unwanted bulk mail, usually advertising. Phishing is deception intended to steal credentials, money or data.
Can a phishing email come from a real address?
Yes, if an attacker has taken over a genuine account or spoofs the sender. Judge the request and links, not only the address.