How to spot a phishing email: 7 practical signs

You get an email from your bank saying your account has been blocked for suspicious activity. The logo is perfect, the copy is well written, the button is red and it asks you to confirm your details "now". It looks legitimate — and that is exactly the problem. Phishing has evolved far beyond the spelling mistakes and odd senders of ten years ago. With generative AI tools, attackers build messages that precisely imitate the tone and visual identity of banks, carriers and government agencies.

Why phishing got harder to detect

The mental filter used to be simple: an email full of spelling mistakes → scam. Today, criminal groups use language models to write fluent copy, copy real templates from legitimate sites and register domains almost identical to the originals. Malwarebytes recorded 42% growth in the volume of phishing campaigns in 2026 — and the emails got significantly more convincing.

What has not changed is the structure of the attack: credential captured → account accessed → damage done. And the 7 signs below still expose the fraud, even when the text looks perfect.

7 signs that reveal a phishing email

1. The sender's domain doesn't match the company

The display name may say "Bank of America" or "DoorDash", but the real address is what matters. Click the sender's name to expand the full address. Legitimate companies send email from their own domains: @bankofamerica.com, @doordash.com. Addresses like @bankofamerica-security.net or @doordash-confirm.com are fake — no exceptions.

2. Artificial urgency or threat

Phrases like "your account will be blocked in 24 hours", "action required: confirm now" or "overdue payment — avoid a penalty" trigger the instinct to act without thinking. That's deliberate: time pressure switches off critical thinking. No bank, carrier or public agency issues ultimatums by email — they have official channels and formal processes for any action that affects your account.

3. The link goes somewhere other than the text says

Hover over any button or link without clicking. The real URL appears in the bottom corner of the browser. If the button says "Access my account" but the URL shows something like http://bank-verification.xyz/login, it's a scam. Pay special attention to URL shorteners (bit.ly, tinyurl.com) — they hide the real destination and are heavily used in mass phishing campaigns.

4. A domain with a subtle error (typosquatting)

Attackers register domains that resemble the originals: paypa1.com (the number 1 in place of the L), netfl1x.com, irs-refund.net (the official domain ends in .gov), chase-app.com. Read the whole domain before clicking, especially in emails from banks, carriers and government. The legitimate domain ends exactly the way you'd expect — no extra hyphens, no additional suffixes, no swapped letters.

5. An unsolicited attachment

Invoices, receipts, tax documents, "important files" — any attachment you weren't expecting is a risk. The .exe, .zip, .docm and .xlsm formats are the favorites for wrapping malware. PDFs and even .svg images have been used in real attacks. If you weren't expecting that file, don't open it before confirming directly with the company through an official channel.

6. A request for data a real company never asks for by email

Banks don't ask for your password, token, card number or SMS code by email. Tax authorities don't send links to "regularize your tax ID" when you haven't started the process on their portal yourself. Services like Netflix or Spotify update payment details directly on the site, not through an email with an embedded form. Any email asking for that information is phishing — no exceptions.

7. Formatting that's off-brand

Even with AI, the details give the forgery away: a slightly different logo, inconsistent typography, colors that don't quite match the app or site, a footer missing the company's registration details, buttons with strange spacing. If you've received legitimate emails from the same company before, compare them. If there's no easy comparison to hand, go into the account directly through the official app or site — not through the link in the email.

How do I verify whether an email is fake?

Open the email's headers and check the SPF, DKIM and DMARC fields — all of them should read "pass". If any of them fails, the email is being sent from a server that doesn't belong to the declared domain, confirming forgery.

In Gmail: open the email → click the three dots in the top right corner → "Show original". Look for Authentication-Results. A legitimate email shows:

spf=pass
dkim=pass
dmarc=pass

Any fail or softfail means the sender isn't who they claim to be. You don't need to understand the entire header — those three fields alone settle the question.

What to do if you already clicked a suspicious link

Don't panic — but act fast:

1. Don't enter any data on the page that opened.
2. Close the tab immediately.
3. Change the password on the affected account by going directly to the official site (not through the email).
4. Review your second authentication factor — if you haven't enabled it yet, now is the moment.
5. Monitor bank statements and access alerts over the following days.
6. If you handed over banking or card details, call the bank immediately.

Phishing is the beginning, not the end of the attack

Most serious incidents start with an email. The Lapsus$ group compromised Uber, Cisco and Microsoft using phishing as the way in back in 2022. Captured credentials frequently feed credential stuffing attacks against other services where the same password was reused. Phishing has also migrated to the QR code — so-called quishing, increasingly common on printed bills and public kiosks — and to the phone, with AI voice vishing that imitates bank managers.

Recognizing the fake email before clicking is the cheapest and most effective defense available. The 7 signs above apply to any sender — a bank, a tax authority, a delivery company or a streaming platform. When in doubt, go in through the official app or site: that simple habit neutralizes most of the attacks in circulation. If you want to strengthen your protection further, the natural next step is setting up a TOTP authenticator on every important account — even if someone captures your password, they can't get in without the second factor.