Phishing emails trick smart people into handing over passwords, money, or data. Use this checklist to spot scams before you click, reply, or download anything suspicious.

1. Spot Suspicious Sender Addresses Fast

Attackers often use email addresses that look close to real ones, with swapped letters or extra domains. Check the full address, not just the display name, because many fakes hide behind a trusted company label.

Look for subtle changes such as missing letters, extra characters, or odd country codes. If the domain ends with a number or an unfamiliar top level domain, treat it with caution.

Pro Tip: Copy the sender address and paste it into a search engine to see if others have flagged it as fraudulent.

2. Check the Greeting and Tone for Red Flags

Legitimate companies often use your real name or account details, while phishing emails use generic greetings like “Dear Customer.” Tone matters, so note if the message tries to panic you or promises large rewards.

Be suspicious of messages that mix formal and informal language, or that have a pushy tone demanding immediate action. These are classic psychological tricks used to bypass careful thinking.

Quick Tip: If the greeting is generic and the sender claims urgency, pause and verify the message through another channel.

3. Hover Before You Click on Links

Hovering reveals the true URL without opening it, showing whether the link points to a suspicious domain. Links can hide malicious destinations behind display text that looks legitimate.

On mobile, press and hold a link to preview the URL or use a long-press preview feature. Never click links that redirect through unrecognized domains or use URL shorteners without previewing them first.

Expert Insight: If a link’s domain does not match the company it claims to be from, assume it is malicious and do not click.

4. Inspect Attachments Before Opening

Attachments can carry malware, especially executables, macro-enabled documents, and compressed files. If an unexpected attachment arrives, verify the sender and the reason for the file before opening it.

Use a sandboxed environment or an online virus scanner for suspicious attachments, and avoid enabling macros in documents you did not request. When in doubt, request the file through a verified file-sharing system.

Insider Tip: Treat .exe, .scr, .zip, and .docm files with extra care, and scan attachments with updated antivirus software before opening.

5. Watch for Urgency and Threats

Scammers create a sense of urgency by warning that your account will be closed or that you owe money. This pressure is meant to make you act without thinking, which is exactly what you should avoid.

Pause and verify any urgent claim by contacting the company directly through a known phone number or website. Real organizations will not demand immediate payment or credentials via unsolicited email.

Heads Up: If the email pressures you to bypass normal procedures, it is likely a scam and should be treated cautiously.

6. Look for Spelling, Grammar, and Odd Formatting

Poor spelling and strange capitalization often reveal low-effort phishing attempts. However, well-crafted scams exist, so this is one indicator among several rather than a sole determinant.

Also check for inconsistent logos, mismatched fonts, or images that fail to load properly. Legitimate corporate emails tend to maintain consistent branding and professional formatting.

Worth Knowing: Minor errors combined with other red flags increase the likelihood of fraud, so multiply your suspicions rather than dismissing them.

7. Verify Requests for Personal or Financial Info

Legitimate companies rarely ask for passwords, full Social Security numbers, or payment details via email. Treat any direct request for sensitive data as a major red flag.

If an email asks you to update payment methods or provide credentials, log in to your account using the official website or app instead of following email instructions. Confirm the request through your account settings or customer support.

Pro Tip: Create a separate checklist for what your bank or service provider will and will not ask for by email, then use it to assess such requests quickly.

8. Examine Email Headers for Authenticity

Email headers contain routing information that helps verify the sender’s origin, including “Received” lines and authentication results like SPF and DKIM. Many email clients hide headers, but you can view them in the message options.

Check for mismatches between the “From” address and the authenticated sending domain. If authentication fails or the path looks strange, treat the message as untrusted and report it to your IT team or provider.

Quick Tip: Learn how to view headers in your email client and keep a simple checklist of header fields to inspect when something feels off.

9. Confirm with a Separate Channel

When unsure, reach out using a phone number or chat available on the official website, not the contact details provided in the suspicious email. Verification through a separate channel stops many scams before they succeed.

For workplace emails, call or message the sender using an internal directory rather than replying to the email, especially if the request involves money or credentials. This step prevents email account spoofing from causing harm.

Expert Insight: When you verify externally, note the timing and content of the conversation in case you need to report the incident later.

10. Beware of Too-Good-To-Be-True Offers

Phishing lures often promise prizes, refunds, or exclusive deals to make victims act quickly. If an offer seems unrealistic compared to what you signed up for, question its legitimacy.

Research the promotion through official channels and user forums, and never provide payment or personal details to claim a prize. Scammers rely on excitement, so let skepticism counteract that emotion.

Insider Tip: Verify any prize claim by logging into the official account portal or contacting customer service directly to avoid falling for a trap.

11. Use Tools and Settings to Reduce Risk

Email filters, multi-factor authentication, and browser safety settings can block many phishing attempts before they reach you. Enable these protections and keep software updated to reduce vulnerability.

Train yourself and your team with phishing simulations and clear reporting procedures. The more people know the signs and how to respond, the fewer successful attacks your organization will face.

Heads Up: Use a dedicated reporting process so suspicious emails are reviewed quickly, and adjust filters based on what your team receives.

Stay Sharp and Share What You Learn

Phishing evolves, but a consistent habit of checking sender details, links, attachments, tone, and requests will catch most scams. Which phishing trick surprised you the most, and will you change one habit after reading this?