How to Spot a Phishing Email in 30 Seconds

An email says your account will close unless you act immediately. Before clicking anything, check three things: who really sent it, what it wants, and where its links lead. That quick scan catches many common phishing attempts.

Thirty seconds cannot prove an email is safe. It can tell you when to stop and verify through a separate channel, which is usually the most useful decision you can make.

Run the 30-second check

Spend roughly ten seconds on each step. You do not need to investigate every detail before deciding that a message deserves caution.

1. Expand the sender details and read the actual email address, not just the display name.
2. Identify the requested action: signing in, paying, opening a file, sharing a code, or moving a conversation elsewhere.
3. Preview the destination of any link without opening it, then decide whether to verify independently.

Treat unexpected requests for passwords, verification codes, gift cards, or changed payment details as warning signs. A familiar logo and polished writing do not cancel those warnings.

If the request is consequential, skip the email link entirely. Open the company's app, use a saved bookmark, or type its known address yourself. Check for the same alert inside your account.

Read the sender, not the costume

The name shown above a message is easy to impersonate. An attacker can label an address “Payroll,” “Customer Support,” or your manager's name without controlling the real organization's mailbox.

In Gmail, open the message and expand the details beside the recipient information. In Outlook, select or expand the sender name to inspect the address. Exact controls vary between desktop and mobile versions.

Compare the domain after the @ symbol with the organization's known domain. Watch for extra words, swapped letters, and addresses from unrelated free email providers. A plausible address is a clue, not a guarantee: legitimate accounts can also be compromised.

A different Reply-To address can deserve attention, especially when the message requests money or sensitive information. However, mailing services sometimes use different sending and reply addresses legitimately. Judge the mismatch alongside the request rather than treating it as proof by itself.

Inspect links and attachments without trusting them

On a computer, hover over a link to see its destination. On a phone, pressing and holding may show a preview, but avoid tapping a preview that opens the page. If you are unsure how your app behaves, leave the link alone.

Read the actual hostname. In an address such as https://accounts.example.com.notice-center.net/login, the controlling domain is notice-center.net, not example.com. Familiar words elsewhere in a URL do not establish ownership.

The padlock and HTTPS mean a connection is encrypted; they do not mean the site is honest. Criminals can operate encrypted websites too. Shortened links also hide information that would help you evaluate the destination.

Unexpected attachments deserve the same skepticism. Do not enable document macros, install a viewer, or open a password-protected archive just because an email instructs you to. If you expected a file, confirm the filename and purpose with the sender through an established contact method.

Notice pressure and unusual requests

Phishing often tries to make speed feel more important than judgment. The message may threaten a suspension, promise a refund, or claim that a private workplace request cannot wait.

Look for these patterns:

• Urgency: A deadline leaves little time to check the story.
• Secrecy: You are told not to contact coworkers or family.
• Payment changes: An invoice suddenly lists different bank details.
• Code requests: Someone wants a one-time sign-in or recovery code.
• Unexpected sharing: A document invitation requires an unfamiliar login.

Bad spelling can be a clue, but good spelling is not a safety signal. Messages can be carefully written, copied from real notifications, or generated with fluent language tools.

Context matters more than tone. An ordinary-looking invoice can be dangerous when its payment instructions have changed. A genuine account warning can look alarming, but you can still check it safely in the official app.

Verify through a channel you already trust

Do not reply to a suspicious email to ask whether it is real. That keeps you inside the channel the attacker controls. Similarly, avoid calling a phone number supplied only in that message.

1. Open the service's official app or a previously saved bookmark.
2. Check notifications, recent activity, orders, or billing details.
3. If needed, call the number on your payment card, statement, or established company directory.
4. For a coworker's request, start a separate conversation using contact details you already have.

For changed vendor bank details, follow your organization's payment-verification procedure even when the email appears in an existing conversation. Attackers sometimes hijack real mailboxes and reply within genuine threads.

The same independent-verification habit works for texts. See Scam Text Messages: Common Types and What to Do for examples involving deliveries, tolls, and fake fraud alerts.

Report it, and respond proportionately

Use your email app's Report phishing option when available. For work or school accounts, follow your security team's reporting process before deleting the message. Do not forward a live attachment casually to coworkers.

If you only opened the email, you usually do not need to reset everything. Remote images may reveal that the message was opened, but opening a message is not the same as handing over your password. Keep the mail app and operating system updated.

If you entered a password, change it through the legitimate service and replace it anywhere you reused it. The Password & Hash Generator can help create a unique replacement; never paste your existing password into an unfamiliar tool.

If you shared a verification code, approved an unexpected login, or see unknown account activity, follow What to Do If Your Email Account Is Hacked. Contact your bank promptly if you shared payment information or sent money. If you downloaded and ran a file, contact workplace IT or use your device's trusted security tools.

Make pausing your default

You do not have to prove that a suspicious email is fraudulent before ignoring its instructions. When money, credentials, or sensitive files are involved, an independent check is enough reason to slow down.

Remember the three-part scan: sender, request, destination. Then move important actions into an app, bookmark, or phone conversation you already trust.