Understanding Phishing Emails: A Beginner's Guide to Spotting Red Flags

A phishing email rarely announces itself as one. It shows up looking like a routine invoice, a delivery notice, or a note from a colleague, and it asks for something small: a click, a login, a reply. The aim is to get you moving before you think. That is the whole trick, and once you recognise the patterns, most of these messages fall apart in the first ten seconds.

Why the dullest emails do the most damage

Attackers do not need to fool everyone. They send the same message to thousands of mailboxes and only need a few people to be busy, tired, or new to the job.

Phishing templates are copied from real services, right down to the logo, the footer and the font. What arrives looks almost exactly like the notification you have seen a dozen times before, which is why urgency does the heavy lifting. "Your account will be closed today." "Confirm the payment before 5pm." Deadlines push people past the check they would normally make.

The lures you will meet most often

Most campaigns reuse a handful of stories. If you recognise the story, you are already suspicious, which is exactly where you want to be.

• Invoice or payment change. A supplier has "updated their bank details" and needs the next payment sent elsewhere. Confirm any change by phone using a number you already have, never one from the email.
• Account or password warning. Sign in to keep access. The link opens a copy of a login page that sends your password to someone else.
• Shared document. "A file has been shared with you." The document button asks for your email password to view it.
• Delivery or customs fee. A small charge is all they want, along with your card details.
• HR, payroll or benefits. Payslips, bonuses and policy updates land harder around payday or year end.
• IT helpdesk. Mailbox full, password expiring, device needs an update, or a request to install remote support software.
• Refunds and tax. Money owed to you, and a short form to claim it.
• Meeting invites and e-signature requests. A calendar invite or signature link that leads somewhere unexpected.

Almost every phish asks for one of three things: click a link, reply with information, or pay. If a message does two of those at once, treat it as hostile until proven otherwise.

Check the address, not the display name

Display names are free text. Anyone can send a message that appears to come from "Payroll" or from your manager's name, so the actual address is what matters. On desktop, hover over the sender name or click it to expand the details; on mobile, tap the name. Then look closely for lookalikes: a domain with an extra word such as -secure, a number one where a letter l should be, or an rn where an m belongs.

If your mail client shows a Reply-To address, check that too. A reply that goes somewhere different from the sender is a strong signal. Greetings are a weaker clue on their own: "Dear Customer" suggests a mass send, but a targeted message can use your name, your job title and a real colleague's name without breaking a sweat.

How to inspect a link without clicking it

1. Hover over the link on a computer, or long-press it on a phone, and read the address that appears.
2. Read the domain from the right. Find the first single slash after the https:// part, then look at the two words immediately to its left. In login.yourbank.com.verify-id.ru, the real domain is verify-id.ru. Everything before it is decoration.
3. Be wary of shortened links, which hide their destination, and of link text that shows one address while pointing at another.
4. If anything feels off, do not click. Open a new tab, type the company's address yourself, or use their app.

A password manager is a useful tripwire here. It will happily fill your password on the real site and stay silent on a lookalike. That silence is a warning, not a bug.

Attachments, QR codes and unexpected login prompts

Unexpected attachments deserve the same suspicion as links. Files that ask you to "enable content" or "enable editing" before showing anything, HTML files, and compressed archives are common carriers. If you were not expecting the file, ring the sender on a number you already have.

QR codes have become popular with attackers because a phone camera often opens the destination without showing it to you first. A code printed in an email is a link you cannot inspect. Skip it and type the address yourself.

One more pattern: repeated multi-factor prompts on your phone when you are not signing in. Someone has your password and is hoping you will approve one prompt to stop the noise. Deny it, then change that password.

If you clicked: contain it quickly

1. Close the page and stop entering information.
2. If you typed a password, change it from a different device.
3. Turn on multi-factor authentication, or reset it if it was already active, and sign out of other sessions.
4. Check your mailbox for forwarding rules, filters and messages you did not send.
5. Tell your IT or security team straight away, even if nothing seems to have happened.
6. If you entered card or bank details, call your bank's fraud line now.

Speed matters far more than blame. Most of the damage happens in the gap between the click and the moment somebody is told.

Reporting: who to tell and what to include

Report the message rather than quietly deleting it. At work, use the "report phishing" button in your mail client if there is one, or forward the email to your IT or security team. Sending it as an attachment preserves the technical headers, which is what investigators need.

Say what you did as well: did you click, open the file, reply, or enter a password? That single detail changes the response completely. For personal accounts, use your provider's report function — "report phishing" rather than plain "spam". In the UK, suspicious emails can be sent to the National Cyber Security Centre's reporting service, and in the US the FTC takes fraud reports at reportfraud.ftc.gov. If money left your account, tell your bank and the police too, because banks work to deadlines when trying to recall a transfer.

One caution: do not forward a live phishing email to colleagues as a warning. The links travel with it. Describe it, or share a screenshot with the link removed.

A two-minute habit

Before acting on anything urgent, put the message through three questions: who is it really from, what exactly are they asking for, and would this normally arrive this way? If the last answer is no, verify through a channel you already trust, such as a phone number saved in your contacts rather than one printed in the email.

That pause costs a couple of minutes. It is the cheapest piece of security most of us will ever install, and it works on the next phishing email as well as this one.

Photo: freestocks.org / Pexels