How to spot a phishing email: five checks, in order

Most phishing advice is a long list with no order. In practice five checks, done in this order, catch nearly everything - and the first two take about five seconds.

1. 1Read the real address, not the display name.
2. 2Compare the Reply-To address with the From address.
3. 3Ask whether this sender has written to you before.
4. 4Name what the email wants you to do.
5. 5If it involves money, a password or a call, verify on a channel you already trust.

“Look for spelling mistakes” is left off on purpose. AI tools made fluent phishing normal - see what AI changed.

The name shown in your inbox is free text: anyone can send mail displaying “Microsoft Support” or your CEO's name. The address behind it is what matters, and on a phone it is hidden by default.

• Gmail on the web: hover over the sender name, or open the message and click the small arrow next to "to me" to see full details.
• Outlook: click or hover the sender name to open the contact card with the full address.
• On a phone: tap the sender name. Do this before reading the rest of the message.

Attackers who spoof or borrow a sending address still need your reply to reach them. A common trick is a From address that looks right with a Reply-To that points somewhere else:

Pressing Reply here sends your answer to a free mailbox the attacker controls. In Gmail, “Show original” reveals all headers; in Outlook, “View message details” does the same.

Search your mailbox for the sender's exact address. If a “supplier you have worked with for years” has never written from this address before, that single fact outweighs everything the email says. Most business email compromise depends on you not checking this.

Put the ask into one plain sentence. If it is on this list, slow down:

Call a number you already have - from your own contacts, a past invoice or the company's website - never one from the email. Or message the person on the chat tool you normally use. It takes two minutes and ends almost every scam on this list.

For the subdomain trick, read the domain from the right: the real owner is whatever comes just before the ending - secure-login.net in the last example, not acme.com.

• On a computer, hover over the link and read the destination in the corner of the window before clicking.
• On a phone, press and hold the link to preview it instead of tapping.
• If the link goes to a login page, close the email and go to the site the way you normally would - a bookmark or typing the address.
• A real service almost never needs you to sign in from an email link to "keep" access.

A large share of email is now read on phones, and phones make every one of the five checks harder. Mail apps show the display name only, links open in one tap, and the browser address bar is too short to show a long domain.

• Tap the sender name every time a message asks for anything. It shows the real address.
• Press and hold a link to preview where it goes instead of tapping it.
• Treat shortened links (bit.ly and similar) in work email as unreadable - you cannot tell where they lead.
• If a message needs action, it can usually wait until you are at a computer. Urgency is the attacker's tool, not yours.

All three are fictional. Try each before reading the answer.

They entered a password

Change it now, sign out all sessions, and check the mailbox for new forwarding or inbox rules.

They opened an attachment

Disconnect the device from the network and tell whoever handles IT before doing anything else.

They paid

Call the bank's fraud line to request a recall, then report it - ic3.gov in the US.