A phishing email does not always arrive with obvious spelling mistakes, strange graphics, or an unbelievable story. Some suspicious messages look polished, use familiar branding, mention a service you actually use, and create just enough urgency to make you act before checking.
That makes the usual advice to simply "look for suspicious emails" less useful than it sounds.
A better approach is to have a repeatable process you can use before clicking a link, opening an attachment, calling a phone number, entering a password, or sending information.
If you are wondering how to tell if an email is phishing, do not rely on one clue. Check the sender, the context, the destination, the request, and the technical evidence together.
The following seven-step framework gives you a practical way to do that.
How to Tell If an Email Is Phishing
Start with one rule: do not interact with a suspicious message while you are still investigating it.
You usually do not need to click anything inside an email to decide whether the message deserves your trust. In many cases, you can verify the claim through a separate channel.
1. Check the Actual Sender Address, Not Just the Display Name
A display name is the large, friendly label your email app may show first. It could say "Account Security," "Support Team," or the name of a company you recognize.
That label should not be treated as proof of identity.
Expand the sender details and inspect the complete email address. Pay particular attention to the domain after the @ symbol.
For example, a message might display a familiar company name while the underlying address belongs to an unrelated domain.
Also watch for subtle domain variations. Attackers can use names that look similar at a glance, hoping that readers will recognize the brand without examining the spelling carefully.
A mismatched domain is a meaningful warning sign, but the opposite is not enough to declare a message safe. Sender information should be considered together with authentication, context, and the action the email asks you to take.
2. Ask Whether the Message Makes Sense in Context
Before studying technical details, ask a simpler question: were you expecting this email?
Unexpected context is often one of the most useful clues.
Be cautious if you suddenly receive a message about:
- a purchase you do not remember making;
- a package you are not expecting;
- a password reset you did not request;
- a login from an unfamiliar device;
- an invoice from a company you do not use;
- a document you were not expecting to receive;
- an account you do not have;
- a prize or refund you never applied for.
An unexpected message is not automatically malicious. Real services send security alerts, billing notices, and other unsolicited notifications.
The important point is that an unexpected claim should be verified independently instead of accepted because the email looks professional.
The Federal Trade Commission recommends contacting the organization through a website, email address, or phone number you already know is genuine when an unexpected message might be legitimate.
3. Inspect Links Before You Follow Them
The words displayed in a link and the destination behind that link can be different.
A button might say "Review Account," while its actual destination points somewhere unrelated to the organization named in the email.
On a desktop, many email clients and browsers let you hover over a link to preview its destination without opening it. On mobile devices, link-preview behavior varies, so avoid interacting with a suspicious link if you cannot safely inspect it.
Look at the hostname carefully.
Consider these fictional examples:
| Displayed Destination | Actual Hostname | What to Notice |
|---|---|---|
| example.com | example.com | The hostname matches, but other checks are still required. |
| example.com | example-security-check.net | The destination is a completely different domain. |
| example.com | example.com.attacker.test | The real registered domain is not example.com. |
| example.com | examp1e.com | A character has been changed to imitate the expected name. |
Do not judge a destination merely because the company's name appears somewhere inside the URL. Domain structure matters.
If the email claims that something is wrong with an account, you often do not need its link at all. Open a new browser tab and navigate to the service yourself using a bookmark, an address you already know, or another trusted route.
4. Treat Unexpected Attachments as Untrusted
An attachment can turn an ordinary-looking message into a much higher-risk interaction.
Invoices, delivery documents, resumes, shared files, security reports, and account statements can all provide believable reasons for an attacker to include a file.
The question is not simply whether the filename looks legitimate.
Ask:
- Was I expecting a file from this sender?
- Does the sender normally deliver documents this way?
- Did I request this invoice, report, or document?
- Can I confirm the file with the sender through another channel?
Do not open an unexpected attachment just to find out what it contains.
If the message appears to come from someone you know, contact that person separately before opening the file. If it claims to come from a company, verify the situation through the company's official website or another established contact channel.
5. Examine What the Email Wants You to Do
Phishing is ultimately about action.
The visual appearance of the email matters less than the behavior it tries to produce.
Be particularly cautious when an unexpected message asks you to:
- enter a password;
- provide a one-time verification code;
- confirm payment or banking information;
- send personal information;
- download software;
- open an unexpected attachment;
- approve a login you did not initiate;
- change account recovery information;
- send money or purchase gift cards;
- act immediately to avoid a threat or penalty.
Urgency deserves special attention because it reduces the time people spend verifying a claim.
A message might claim your account will be closed within minutes, a payment has failed, a package cannot be delivered, or suspicious activity requires immediate confirmation.
Urgency alone does not prove phishing. Legitimate security notifications can also be time-sensitive.
The correct response is not to ignore every urgent message. It is to verify the underlying claim without relying on the contact information, link, or phone number supplied by the suspicious message.
6. Use Email Headers as Supporting Evidence
If the basic checks leave you uncertain, email headers can provide additional technical context.
Headers may contain information about message routing, sender domains, reply destinations, and authentication results such as SPF, DKIM, and DMARC.
For example, an unexpected Reply-To address on an unrelated domain may deserve investigation. Authentication failures may also provide useful evidence that the message is not authorized in the way it claims.
But email headers need to be interpreted carefully.
An authentication pass does not prove that every statement in a message is trustworthy. A legitimate domain or account can be abused, and a real company can send an email that still deserves independent verification.
Likewise, one unfamiliar server name inside a Received header does not automatically mean the message is malicious.
If you want to understand these fields in detail, read our guide to what email headers reveal. It explains From, Reply-To, Received, Message-ID, Authentication-Results, and other common fields without treating them as stronger evidence than they actually are.
7. Verify the Claim Outside the Email
This is the most important step when the consequences matter.
If an email claims there is a problem with your bank, do not use the phone number or link in that email. Use the bank's official app, type the known website address yourself, use a trusted bookmark, or call the number printed on your card or statement.
If a coworker unexpectedly asks you to open a document, confirm with that person through another established communication channel.
If an online service says someone changed your password, open the service independently and inspect your account activity.
This breaks one of phishing's most useful advantages: controlling both the warning and the route you use to respond to that warning.
The FTC and Microsoft both recommend independent verification when a suspicious message could plausibly be legitimate.
The 7-Step Phishing Email Verification Framework
When you need a quick process, use the following sequence before interacting with the message:
- Sender: Inspect the complete sender address and domain.
- Context: Ask whether you expected the message or action.
- Links: Inspect destinations without following suspicious links.
- Attachments: Do not open unexpected files before verification.
- Request: Identify exactly what the sender wants from you.
- Headers: Use technical metadata as supporting evidence when necessary.
- Independent verification: Confirm the claim through a trusted channel outside the message.
The framework is deliberately ordered from simple checks to deeper verification. Most people do not need to become email security specialists to avoid common phishing attempts. They need a process that prevents an unverified message from controlling their next action.
Phishing Signal vs Evidence Matrix
| Signal | How Useful Is It? | What It Means |
|---|---|---|
| Spelling or grammar mistakes | Weak clue | Can appear in phishing, but polished phishing can contain perfect writing. |
| Unexpected urgency | Moderate warning | Raises suspicion, especially when combined with a request for immediate action. |
| Unrelated sender domain | Strong warning | The visible identity and actual sender information do not align as expected. |
| Suspicious link destination | Strong warning | The action leads somewhere different from the destination the message implies. |
| Unexpected attachment | Strong warning | Do not open it until the sender and context are independently verified. |
| Request for password or security code | High-risk request | Stop and verify the request through the service itself. |
| Authentication failure | Useful technical evidence | Can indicate a sender authentication problem, but interpretation requires context. |
| Authentication pass | Not proof of safety | Supports domain authentication but does not guarantee that the message or request is trustworthy. |
| Claim confirmed in official account or app | Strong independent evidence | The claim exists outside the suspicious email, reducing reliance on the message itself. |
Why Grammar Is No Longer a Reliable Phishing Test
For years, people were told to identify phishing by looking for bad spelling and awkward sentences.
Those can still be clues, but they are poor filters when used alone.
A legitimate email can contain a typo. A malicious email can be grammatically perfect.
Templates, translation tools, writing assistants, and generative AI make it easier to produce polished messages. Even without those tools, attackers can simply copy the style of legitimate notifications.
That is why structural clues are more useful.
Who actually sent the message? Where does the link go? Were you expecting the request? What information is being requested? Can the claim be verified independently?
Those questions remain useful even when the writing looks professional.
Can a Phishing Email Know Your Real Name?
Yes.
A message using your correct name is not proof that it came from a trusted sender.
Email addresses, names, phone numbers, usernames, purchase information, and other personal details can be exposed through data breaches, public profiles, compromised accounts, marketing databases, or other sources.
That information can make a fraudulent message more convincing.
This is another reason not to use personalization as authentication. A sender knowing something about you does not prove who the sender is.
Reducing unnecessary exposure of your permanent address can limit one piece of information available for future targeting. Our guide on protecting your email from spam explains practical ways to separate low-priority signups from your main inbox.
What If You Already Clicked a Suspicious Link?
What to do next depends on what happened after the click.
If you only opened a page and did not enter information, download anything, approve permissions, or install software, the response may be different from a situation where credentials or financial information were submitted.
If you entered a password into a suspected phishing page, change that password through the legitimate service. If you reused the same password elsewhere, replace those reused credentials too.
If you provided sensitive identity or financial information, follow the official response process appropriate to the information involved.
If you opened an attachment or downloaded something suspicious, follow your operating system and security software guidance for checking the device.
The FTC advises people who believe malicious software may have been downloaded to update their security software, run a scan, and remove items identified as a problem.
What If the Email Contains a Real Verification Code?
A real verification code does not automatically make the surrounding request safe.
If you receive an OTP or login code you did not request, someone may have entered your address accidentally or may be attempting to access an account associated with it.
Do not send an unexpected verification code to another person. Do not enter it into a page reached through a suspicious message.
Instead, access the relevant service independently and check whether there is an account event that requires attention.
For a broader explanation of verification messages and temporary inboxes, see our guide to verification codes and temporary email.
Can Temporary Email Protect You From Phishing?
Temporary email can reduce exposure of your permanent email address during short-term, low-risk interactions. It does not detect phishing for you and does not make unsafe links or attachments safe.
The benefit is separation.
If a website only needs an address for a short-lived interaction, using a temporary email address can keep that interaction away from the permanent inbox connected to your important accounts.
That can reduce unnecessary sharing of your primary address, but it should not replace normal security practices.
For banking, healthcare, government services, financial accounts, sensitive business systems, important subscriptions, password recovery, or anything requiring long-term ownership, use a secure permanent email address that you control.
Temporary inboxes are intended for temporary, low-risk tasks.
A Quick Checklist Before You Trust an Email
- Expand the sender information and inspect the complete address.
- Check whether the sender domain matches the organization being claimed.
- Ask whether you expected the message.
- Do not follow an unexpected link just to investigate the claim.
- Do not open an unexpected attachment.
- Identify what information or action the message requests.
- Be cautious when urgency is combined with credentials, payments, codes, or downloads.
- Use email headers as supporting evidence, not absolute proof.
- Verify important claims through an independent trusted channel.
- Report and delete phishing messages after you have finished checking them.
Frequently Asked Questions
What is the easiest way to tell if an email is phishing?
Start by checking the actual sender address, whether you expected the message, and what action it asks you to take. Do not use the message's own link or phone number to verify its claim. For anything important, open the company's official website or app independently and check the account there.
Can a phishing email come from a real email address?
A familiar-looking address should not be your only test. Accounts can be compromised, sender information can be misleading, and legitimate infrastructure can sometimes be abused. Evaluate the request, context, destination links, authentication information, and independent evidence together rather than trusting one field.
Does bad grammar mean an email is phishing?
No. Poor grammar can be a warning sign, but it is neither necessary nor sufficient to identify phishing. Legitimate messages can contain mistakes, while malicious messages can be professionally written. Sender domains, unexpected requests, link destinations, attachments, and independent verification provide more useful evidence.
How can I check a suspicious email without clicking the link?
Inspect the sender information and link destination without opening it when your email client safely supports that. More importantly, verify the claim separately. Open a new browser tab and navigate to the organization's known website or app rather than using the link supplied in the suspicious message.
Does SPF, DKIM, or DMARC passing mean an email is safe?
No. Authentication results provide technical evidence about domains and message authentication, but they do not guarantee that the content is truthful or harmless. A message can pass authentication and still contain a dangerous or deceptive request. Authentication should be one part of a broader verification process.
Should I reply to a suspicious email to ask if it is real?
Do not rely on replying to the suspicious message as your verification method. If the sender is being impersonated, you are still communicating through a channel controlled by the message. Contact the person or organization separately using contact information you already trust.
What should I do with a phishing email after checking it?
Use the reporting feature provided by your email service when available, then delete the message. Reporting can help providers improve filtering. In the United States, the FTC also provides phishing and fraud reporting guidance through its official consumer resources.
Final Thoughts
The best phishing test is not a single visual clue.
A professional logo does not prove authenticity. Correct grammar does not prove authenticity. Your real name does not prove authenticity. Even a successful email authentication result does not prove that every request inside a message is safe.
Instead, use a process: inspect the sender, consider the context, examine the requested action, avoid unexpected links and attachments, use technical evidence when useful, and verify important claims outside the email.
That habit removes much of the pressure phishing messages depend on.
For short-term, low-risk interactions where you do not need to expose your permanent inbox, Temp-Mail.ID provides a separate temporary address for receiving email. Keep important accounts connected to a permanent address you control, and treat temporary email as an inbox-separation tool rather than a replacement for account security.