How to tell if an email is phishing: a 12-point checklist

Phishing emails try to trick you into handing over passwords, payment details or access to your device by pretending to be someone you trust — your bank, a delivery company, your employer, a streaming service. Some are clumsy. Many are now well-written and visually identical to the real thing.

You don’t need to be a security expert to catch most of them. You need a habit: pause, then check a few specific things before you click anything. This checklist covers those things.

The 12-point phishing checklist

1. Does it create urgency or fear?

“Your account will be suspended in 24 hours.” “Unusual sign-in detected — verify now.” “Final notice: payment failed.” Pressure is the most common phishing ingredient because it stops you thinking. Legitimate companies rarely threaten immediate consequences by email.

2. Who is it really from?

The display name (“PayPal Support”) can be anything. Look at the actual address after it. Watch for:

• Free webmail addresses claiming to be a company (support.bank@gmail.com).
• Lookalike domains: extra words (yourbank-security.com), swapped characters (rnicrosoft instead of microsoft), or different endings (.co instead of .com).
• Subdomain tricks: yourbank.com.account-check.net belongs to account-check.net, not your bank. Read the domain from right to left: the registered domain is the name immediately before the ending (.com, .net, or two-part endings like .co.uk).

3. Does the Reply-To differ from the sender?

If you hit reply and the address changes to something unrelated, be suspicious. This is common in invoice and “CEO” scams.

4. Where do the links actually go?

On a computer, hover over a link (don’t click) and check the address shown at the bottom of the window. On a phone, long-press to preview. If the visible text says one thing and the destination is another, or the domain is unfamiliar, don’t open it.

Also be wary of link shorteners and of buttons that lead to pages asking you to sign in.

5. Is it asking for credentials or payment details?

Reputable services don’t ask you to confirm your password, PIN, full card number or one-time code by email. Anything asking you to “verify your identity” through a link deserves extra scrutiny.

6. Is there an unexpected attachment?

Unexpected invoices, “scanned documents”, voicemail files, shipping labels and HTML attachments are classic malware and credential-harvesting tricks. Be especially careful with Office files that ask you to “enable content” or “enable macros”, compressed archives, and files with double extensions like invoice.pdf.exe.

7. Does the greeting fit?

“Dear customer” or “Dear user” from a company that knows your name is a mild warning sign. On its own it proves nothing — but combined with other signs, it adds up.

8. Does it match what you were expecting?

A delivery notification when you haven’t ordered anything. A password reset you didn’t request. A shared document from someone you’ve never worked with. Context is one of the strongest signals. If you weren’t expecting it, verify it independently.

9. Is the request unusual for that sender?

Your manager asking you to buy gift cards. A supplier announcing new bank details for payments. A friend urgently needing money. These are classic social-engineering moves, even when the sender’s account looks genuine — accounts get compromised.

10. Are there odd details in the design or writing?

Low-resolution logos, mismatched fonts, awkward phrasing and spelling errors used to be the main giveaway. They’re less reliable now, since attackers increasingly produce polished messages, but they still count when present.

11. Does your mail app show a warning?

Many providers flag messages that fail authentication checks or come from outside your organisation, or show “This message seems dangerous”. Don’t ignore these banners. Conversely, the absence of a warning doesn’t mean the email is safe.

12. Does it pass the “go direct” test?

The most reliable check of all: don’t use anything in the email. Open a new tab, type the company’s address yourself or use their official app, and log in from there. If there’s genuinely a problem with your account, you’ll see it. If someone called or emailed with a request, contact them through a number or address you already have.

A quick reference table

Red flag	What to do
Urgent threat or deadline	Slow down; verify via the official app or site
Sender domain looks off	Treat as phishing
Link destination doesn’t match	Don’t click
Asks for password, code or card	Never provide by email
Unexpected attachment	Don’t open; confirm with the sender another way
Change of payment details	Call the supplier on a known number
Gift card request	Almost always a scam

How technical checks help (and where they don’t)

Email providers use authentication standards called SPF, DKIM and DMARC to check whether a message really came from the domain it claims. When these fail, your provider may send the message to spam or show a warning.

They’re helpful, but they don’t make phishing impossible. A message can pass every check if it was sent from a lookalike domain the attacker owns, or from a genuine account that’s been compromised. That’s why the human checks above still matter.

If you’re curious, most mail apps have a “Show original” or “View source” option that displays the authentication results for a message.

What to do with a phishing email

• Don’t click links, open attachments or reply.
• Report it using your mail app’s “Report phishing” or “Report spam” option. This helps filters protect other people.
• Forward it to the impersonated company if they publish a dedicated phishing-report address (many banks do — check their official website).
• Report to national services where available. In the UK you can forward suspicious emails to report@phishing.gov.uk. In the US, the FTC accepts reports at reportfraud.ftc.gov, and the Anti-Phishing Working Group accepts forwarded phishing at reportphishing@apwg.org.
• Delete it.

What to do if you already clicked

It happens to careful people too. Act quickly:

1. If you entered a password, change it immediately on the real site — and anywhere else you used the same password.
2. Turn on two-factor authentication for that account if it isn’t already.
3. If you entered card or bank details, contact your bank using the number on your card.
4. If you opened an attachment, disconnect from the network and run a full scan with up-to-date security software. On a work device, tell your IT team right away.
5. Check account activity — recent logins, forwarding rules and recovery settings — for changes you didn’t make.
6. Watch for follow-up attacks, which often reference the first one.

Reducing your exposure in the first place

Phishing works by volume: the more places your address appears, the more targeted mail you’ll receive. A few habits help:

• Keep your main address for important accounts only.
• Use a temporary email for one-off sign-ups, and an alias for accounts you keep.
• If phishing arrives at an alias, you immediately know which service leaked it — and can switch that alias off.

Remember that a temporary inbox can receive phishing too. The same checklist applies everywhere. For more on cutting down unwanted mail, see how to stop spam emails for good.