How to spot a phishing email: 7 signs and a header check

To spot a phishing email, ignore how polished it looks and check three things: the real sender address behind the display name, where the links actually lead, and what the message wants you to do. If it pushes you to sign in, pay or open a file in a hurry, verify it through a channel you chose yourself.

That order matters because the old tells have faded. The US cybersecurity agency CISA now says it plainly: "A common sign used to be poor grammar or misspellings although in the era of artificial intelligence (AI) some emails will now have perfect grammar and spelling, so look out for the other signs."

Phishing is also the most common complaint the FBI receives. Its Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints in 2025, more than any other crime type, with reported losses of $215.8 million, up from $70 million the year before.

What are the signs of a phishing email?

These seven are ordered by how well they hold up against a well-written fake. The first four work even when the email is flawless.

1. It asks for something a real company would not ask for by email. A password, a verification code, card details, or a "confirm your account" link. The FTC is blunt about this: "legitimate companies won't email or text with a link to update your payment information."
2. The sender's address does not belong to the company. The display name says "Microsoft Support" and the address ends in gmail.com, or in a domain that is one character off. Microsoft's own examples are micros0ft.com, with a zero, and rnicrosoft.com, where an "r" and an "n" stand in for the "m".
3. The link goes somewhere other than what the text says. The button says "View invoice" and the address behind it is a domain you have never heard of.
4. Replies would go to a different address. The From line shows the company, but hitting Reply fills in a free mailbox on another domain.
5. It manufactures urgency. Your account closes in 24 hours, a payment failed, a package is being returned. Urgency exists to stop you from doing checks one to four.
6. You were not expecting it. An invoice for something you did not buy, a shared document from someone who never shares documents, a password reset you did not request.
7. The greeting is generic or the details are slightly wrong. "Dear customer", an old logo, a signature with no phone number. Useful when present, meaningless when absent.

One sign alone proves little. Two or more, especially one of the first four plus urgency, means treat it as phishing.

How do I see the real sender address?

Mail apps show the display name first, and the display name is whatever the sender typed.

• Gmail on a computer: open the email and click the down arrow below the sender's name. Gmail shows the full address plus a "mailed-by" and "signed-by" line with the domain that actually sent it. A question mark next to the sender's name means Gmail could not authenticate the message.
• Outlook: a "?" in the sender's picture means Outlook could not verify the sender. A banner saying it could not verify the sender means something in the headers looked wrong.
• On a phone: tap the sender's name at the top of the message. Most mail apps expand it into the full address.

Read the domain from right to left. In paypal.com.account-check.net, the real domain is account-check.net. Everything to the left of it is decoration.

How do I check a link without clicking it?

On a computer, rest the mouse pointer on the link and read the address that appears, usually at the bottom of the window. On a phone, press and hold the link until a preview with the full address appears. Microsoft's phishing guidance describes both: long-press on Android, and a light long-press on iPhone.

If the email is from a company you really use and you are still unsure, skip the link entirely. Open a new tab, type the company's address yourself or use your bookmark, and sign in there. If the message was real, the same notice will be waiting in your account.

The 60-second header check

Signs are judgment calls. Headers are evidence. Every email carries a hidden block of technical lines, including the result of three checks your own mail provider ran when the message arrived. You can read them by hand, but it is faster to paste them into a tool.

1. Open the suspicious email on a computer. Do not click anything inside it.
2. Get the original message. In Gmail, click the three dots next to Reply, choose Show original, then Copy to clipboard. In Outlook on the web or the new Outlook, click the three dots at the top of the message, then View, then View message details, and copy the text.
3. Open Secria's free email header analyzer, paste, and click Analyze headers. It runs in your browser and nothing you paste is uploaded.
4. Read the summary box at the top. Green says "Looks normal". Amber says "Worth a closer look". Red says "Be careful with this one".

Then look at three lines in the results:

For a forged bank email, the summary reads: "SPF fail, DKIM none, DMARC fail. The From address may be forged. Be careful with links, attachments and payment requests." It also flagged that replies would go to a different domain from the sender. That is a fake, settled in under a minute.

What a pass does not prove

This is the part most guides leave out. A pass on all three means the email really came from the domain in the From line. It says nothing about whether that domain is honest. A scammer who registers harborbank-secure.example can set up SPF, DKIM and DMARC correctly, and every check will pass for that domain. So after a pass, read the domain itself one more time and ask whether it is the company's real one.

A fail, on the other hand, is strong evidence. If DMARC fails on a message asking you to pay, sign in or open an attachment, treat it as fake.

What should I do with a phishing email?

Do not reply, and do not use any link in it, including "unsubscribe". CISA's advice is to report it and then delete it. Reporting takes a few seconds and trains the filter for everyone using the same provider.

The Gmail, Outlook and Apple steps come from each company's current help pages (Google, Apple), and the two US addresses from the FTC's phishing page.

If the fake pretends to be a company you deal with, tell that company too. Most banks and large retailers publish a dedicated address for it.

What if the email says it is from my own provider?

Security alerts are the favorite disguise because people act on them fast. Two facts help. Google states that if you are already signed in, its emails will not ask you to enter your password, and that you can check any alert yourself at myaccount.google.com/notifications without touching the email. Yahoo says it never asks for your password in emails or phone calls. The same habit works everywhere: go to the account's security page directly and look for the alert there.

Sign-in methods that cannot be typed into a fake page take this whole problem off the table. That is the case for passkeys and security keys, which we rank against text codes and authenticator apps in our guide to how safe two-factor authentication is.

Frequently asked questions

Can I get hacked just by opening a phishing email?

Opening the message is rarely the problem. The harm comes from what you do next: typing a password into the linked page, opening an attachment, or approving a sign-in. Opening can still tell the sender your address is live if your mail app loads remote images, which is how a tracking pixel works.

How can I tell if an email is from a real company?

Check the domain after the @ in the full sender address, check where the links lead, and when in doubt go to the company's site yourself instead of using the email. For proof, run the header check above. A DMARC fail on the company's domain means the company did not send it.

Do phishing emails always have spelling mistakes?

No. CISA notes that in the era of AI some phishing emails have perfect grammar and spelling. Treat clean writing as neutral, and rely on the sender address, the link destination and what the message asks for.

Is it safe to click unsubscribe in a suspicious email?

No. In a phishing email the unsubscribe link is one more link controlled by the sender. Report the message as phishing and delete it. For real newsletters, use the unsubscribe button your mail app adds, which we explain in our guide to stopping spam emails.

The short version

Look past the display name, read the link before you touch it, and be suspicious of anything urgent that wants a password, a payment or a download. When it matters, the header check turns a hunch into a result. And if you want an inbox that gives senders less to work with, Secria Mail removes tracking pixels automatically and senders never see your IP address.