How to Spot a Phishing Email Before You Click

Check the sender's real domain, not the display name

The display name on an email is just text the sender chooses. It costs nothing to type "PayPal Support" or "Microsoft Security Team" into that field, regardless of where the message actually came from. The part that matters is what comes after the @ symbol in the full email address, and most mail apps hide that by default, showing only the friendly name.

Tap or click on the sender's name to expand the full address. Then compare it carefully to the company's real domain. Scammers rely on you skimming, so the fakes are built to survive a glance: an extra letter (paypa1.com), a swapped character (rnicrosoft.com), an added word or hyphen (amazon-security.com), or a domain that puts the real brand name as a subdomain of something else entirely (paypal.com.account-verify.net, where the actual domain is account-verify.net, not paypal.com). The real domain is always the part immediately before the final dot-something, reading right to left from the @ symbol.

Urgency and fear tactics are the biggest giveaway

"Your account will be suspended in 24 hours." "Suspicious login detected, verify now." "Unpaid invoice, action required immediately." These messages are built to make you react before you think. Fear and time pressure are the single most consistent pattern across phishing attempts, because they short-circuit the careful checking that would otherwise catch the fake sender or the fake link.

Real companies do send security notifications and do have real deadlines, so urgency alone isn't proof of a scam. What's telling is the combination: urgency plus a demand to act right now through a link in the email, rather than by logging into the app or site you already know and trust. If a message makes your stomach drop and pushes you toward an immediate click, that's exactly the moment to slow down, not speed up.

Hover before you click: verify the real destination URL

A link's visible text and its actual destination are two completely separate things. A link that reads "Sign in to your account" can point anywhere the sender wants. Before clicking anything in an email you weren't expecting:

• On a computer, hover your mouse over the link without clicking. Most email clients and browsers show the real destination URL in a small tooltip or in the status bar at the bottom of the window.
• On a phone, press and hold the link (don't tap) to preview the destination URL before it opens.
• Read the domain the same way you checked the sender: the part right before the final dot-something is what actually matters. A link that appears to go to "yourbank.com/login" but actually resolves to a different domain entirely is a hard red flag.
• Be extra cautious with shortened links (bit.ly, tinyurl, and similar) in unsolicited email. They hide the real destination completely, and legitimate companies rarely need to shorten a link inside a security or billing email.

Generic greetings vs. the personalization real companies use

Companies you actually have an account with already know your name, and usually a detail like the last four digits of a card or account number, because you gave it to them. Their real emails tend to reflect that: "Hi Sarah," or "Your Visa ending in 4821 was charged $54.00," not "Dear Customer" or "Valued User." A generic greeting from a company that should know exactly who you are is worth a second look.

That said, treat this as one signal among several, not a guarantee. Scammers increasingly personalize phishing emails using names and details pulled from old data breaches or public profiles, so a message that gets your name right isn't automatically safe. Use the greeting as a tiebreaker alongside the sender domain and link checks, not as the deciding factor on its own.

Why legitimate companies rarely ask for this by email

Banks, payment processors, tax agencies, and major tech companies almost never ask you to type a full password, a PIN, a one-time 2FA code, or a credit card number by clicking a link and filling out a form. Their actual security practice is the opposite: they tell you to log in independently, through the app or by typing the known address yourself, precisely because email is such an easy channel to spoof.

Treat any of the following as a serious red flag, regardless of how convincing the rest of the email looks:

• A request to "confirm your password" or "verify your card number" by entering it on a page reached through the email link.
• A request to read out or type in a one-time 2FA code you just received, especially if you didn't just try to log in yourself.
• A demand for payment via gift card, wire transfer, or cryptocurrency to resolve an "overdue" bill or "legal" issue.
• An attachment you weren't expecting, especially a "invoice," "voicemail," or "shipping document" with an unusual file type.

Already clicked a suspicious link? Do this now

1. If a login page loaded and you didn't type anything, just close the tab. Nothing was entered, so nothing was compromised on that front.
2. If you typed in a password, go to the real site directly, by typing the address yourself or using a bookmark, never through the email link, and change that password immediately. Change it everywhere else you reused it too.
3. Turn on two-factor authentication on that account if it wasn't already active, so a leaked password alone isn't enough to get in.
4. If you opened an attachment, run a full malware scan with your antivirus software before doing anything else on that device.
5. Watch your bank, card, and account activity for a few weeks afterward, and report anything unfamiliar immediately.
6. Report the email using your email provider's "report phishing" option, and forward it to the real company's official abuse or security address if you can find one.

If the account involved uses two-factor authentication tied to a phone number or authenticator app, and you're worried the attacker also has access to that, our guide on restoring authenticator codes after a phone change covers how to regain control without locking yourself out.

We help travelers with this from wherever you are: