Before you start
- An email account
Warning signs of a phishing email
- Odd sender address: “PayPal” from [email protected].
- Urgency or threats: “Your account will be closed in 24 hours.”
- Requests for passwords, codes or card details: real companies don’t ask by email.
- Links that don’t match: hover to see the real address.
- Unexpected attachments: invoices, ZIPs, “documents” you didn’t expect.
- Generic greetings: “Dear customer”.
- Too good to be true: prizes, refunds, crypto returns.
- Payment changes: “Our bank details changed, pay this account.”
- QR codes asking you to “verify” accounts.
- Spelling and design mistakes (though modern scams can look perfect).
Method 1 Check before you click
-
Step 1: Inspect the sender
Tap or click the sender’s name to see the full email address and check the domain carefully.
-
Step 2: Inspect links
Hover over a link on a computer, or long-press on a phone, to preview the real address. Look at the domain right before the first single “/”.
-
Step 3: Go direct
Instead of clicking, open the company’s app or type its address yourself and check your account there.
Method 2 Report and delete
-
Step 1: Gmail
Open the email, tap ⋮ and choose Report phishing.
-
Step 2: Outlook
Select Report > Report phishing.
-
Step 3: Forward to authorities
Many countries have reporting addresses, e.g. [email protected], the UK’s [email protected], or the US FTC at reportfraud.ftc.gov.
Method 3 If you clicked or entered details
-
Step 1: Change the password
Immediately change the password for that account (and anywhere you reused it), from the real website.
-
Step 2: Turn on two-step verification
This blocks most takeovers even if the password leaked.
-
Step 3: Contact your bank
If you entered card or bank details, call your bank using the number on your card.
-
Step 4: Scan your device
If you opened an attachment, run a full antivirus scan.
Troubleshooting
A real email looks like phishing
When unsure, don’t click. Contact the company via its app or website; a genuine message will be confirmed there.
Frequently asked questions
Can opening a phishing email infect me?
Simply opening is usually safe in modern email apps. Clicking links, opening attachments or entering details is the danger.
Do scammers use SMS and WhatsApp too?
Yes (smishing). The same warning signs apply.
Summary
Check the real sender, preview links, distrust urgency and unexpected attachments, and go to the company’s site yourself. Report phishing, and if you clicked, change passwords and turn on 2FA right away.
