Phishing emails used to be easier to spot.
A strange sender address, terrible spelling and a message beginning with “Dear Customer” were often enough to make you suspicious.
That still happens. But it is no longer the whole story.
Phishing has become much better at looking like the real thing. A message can use familiar branding, mention a service you actually use and create a convincing reason for you to act. Recent scams have even used fake event invitations to trick people into entering their email credentials. (Consumer Advice)
That makes knowing how to spot phishing email 2026 less about finding one obvious mistake and more about learning to question what an email is asking you to do.
The good news is that you do not need to be a cybersecurity expert to do that.
You just need to slow down.
What is a phishing email?
Phishing is a form of social engineering. Instead of breaking into an account directly, a scammer tries to persuade you to hand over the information or access they need.
The email may pretend to come from your bank, employer, colleague, delivery company, streaming service or another organisation you recognise.
The goal can vary.
A phishing email might try to get you to:
- Enter your username and password
- Share financial information
- Change payment details
- Open a malicious attachment
- Download software
- Click a malicious link
- Send sensitive information
- Approve a login or other action
CISA describes phishing as an attempt to obtain information or get someone to download malicious software by pretending to be a trustworthy entity. (CISA)
That is why the sender’s name is not enough.
The question is what the email wants you to do.
Start with the sender, not the logo
A familiar logo can make an email feel legitimate within seconds.
Ignore it.
Look at the actual sender address.
Someone may send an email using the name of your bank, your boss or a company you recognise, while the address underneath belongs to an entirely different domain.
For example, an email might display:
Your Bank
But the actual address could be something completely unrelated.
Scammers can also use addresses that look almost correct. A single altered character or an unfamiliar domain ending can be easy to overlook when you are reading quickly.
CISA specifically lists suspicious sender addresses that imitate legitimate businesses as a sign of phishing. (CISA)
Before responding, check the full address.
If the message claims to come from your employer, does the domain match your organisation?
If it claims to come from a company you use, does the sender address actually belong to that company?
If it does not make sense, stop there.
Do not trust the display name
Your inbox may show only the sender’s name rather than the full address.
That is convenient, but it is also easy to manipulate.
An attacker can set the display name to something familiar, making an email appear to come from a person or organisation you know.
Open the sender details and inspect the actual address.
This is particularly important for emails that appear to come from senior colleagues asking you to transfer money, buy gift cards, share information or take another unusual action.
If the request is unexpected, verify it through another channel.
Do not reply to the suspicious email and ask, “Did you send this?”
If the account has been compromised, you may simply be talking to the attacker.
Be suspicious of urgency
Phishing works best when you do not have time to think.
That is why urgency appears so often.
Your account will be closed.
Your payment has failed.
Your package cannot be delivered.
Your password will expire.
Your invoice is overdue.
You have received a refund.
You need to verify your identity today.
The message creates a problem and then gives you a convenient button to solve it.
That combination is a major warning sign.
CISA and the FTC both identify urgency and unexpected requests as common elements of phishing attempts. (Federal Trade Commission)
When an email tells you that something must happen immediately, pause before doing anything.
Ask yourself:
What happens if I do nothing for ten minutes?
Usually, nothing.
And those ten minutes give you time to verify the request properly.
Look at where the link actually goes
A link can say one thing while taking you somewhere completely different.
That makes the visible text of a link less useful than its actual destination.
On a computer, hover over a link without clicking it. Your email application should show the destination.
On a phone, you may need to press and hold the link to preview where it leads, depending on the email app.
Look carefully at the domain.
A long or complicated URL is not automatically malicious. A short URL is not automatically safe either.
What matters is whether the destination actually belongs to the organisation that supposedly sent the message.
CISA specifically warns about spoofed hyperlinks where the destination does not match the text shown in the email. (CISA)
If an email from your bank sends you to an unfamiliar website to “verify your account”, do not continue.
Open your bank’s official app or type its known website address yourself.
That removes the suspicious link from the equation.
Never log in through a suspicious email
This is one of the most useful habits you can build.
If an email tells you there is a problem with your account, do not use the login button inside the email.
Go directly to the service.
Open the official app.
Type the website address yourself.
Use a bookmark you already trust.
Then check whether the supposed problem actually exists.
The FTC recommends contacting a company through a phone number or website you know is genuine rather than using information provided in a suspicious message. (Consumer Advice)
If your Netflix account really needs attention, you should be able to find out after logging in normally.
If your bank really needs you to update something, the official banking app should tell you.
The same principle applies at work.
If your company’s IT team supposedly needs you to reset your password, use your normal company portal or contact the IT team through its established channel.
Treat unexpected attachments carefully
A document attached to an email can look harmless.
It might be an invoice, receipt, delivery notice, CV or spreadsheet.
That does not make it safe.
CISA identifies suspicious attachments and requests to download files as common signs of phishing. (CISA)
Be particularly careful when you were not expecting the attachment.
Ask yourself:
Was I expecting this person to send me a file?
Was I expecting this type of document?
Does the message give me a believable reason for receiving it?
If the answer is no, verify it before opening.
Do not let the file name convince you that it is safe.
And never enable macros or other active content simply because an unfamiliar document tells you to.
Spelling mistakes are no longer enough
This is one of the biggest misconceptions about phishing.
Poor grammar can still be a clue.
But a polished email can still be malicious.
CISA lists misspellings, poor grammar and inconsistent formatting among potential warning signs, but they are only part of the picture. (CISA)
A convincing phishing email can have professional formatting, a realistic logo and a perfectly written message.
That is why the old test of “Does this email look professional?” is not reliable enough.
Instead, look at the request.
Does the message suddenly need your password?
Is it asking you to change payment details?
Is someone asking you to bypass the normal approval process?
Does it contain a link you were not expecting?
Is it creating unusual urgency?
Those questions are much harder for a convincing design to hide.
Be careful when the email knows something about you
Personalisation can make a phishing email much more convincing.
Your name, job title, company, recent activity or a service you actually use can make the message feel legitimate.
But information about you does not prove that the sender is legitimate.
Some of that information may already be available publicly. Other details may have come from previous data breaches, compromised accounts or information gathered from other sources.
CISA specifically notes that spearphishing can target individuals using information about them to make the message more convincing. (CISA)
So if an email says your name, mentions your company and refers to a service you use, do not stop investigating.
Ask whether the request itself makes sense.
Watch for unusual requests from people you know
A phishing email does not have to come from a stranger.
Sometimes the sender appears to be someone you know.
This can happen when an account has been compromised or when an attacker creates an address that looks like the real one.
Imagine receiving an email from your manager saying:
“Are you available? I need you to handle something quickly.”
The request may seem harmless.
Then comes the second email asking you to purchase gift cards, transfer money or share confidential information.
That is when the normal relationship between you and the sender becomes the attacker’s advantage.
If a request is unusual, verify it outside the email.
Call them.
Send a message through your usual work chat.
Speak to them in person.
The FTC recommends contacting a colleague, friend or company through a separate, trusted channel when an unexpected request appears. (Federal Trade Commission)
Your bank probably does not need you to click that link
Financial phishing deserves particular attention because the consequences can be immediate.
A message might claim:
- There was a suspicious login
- Your account has been restricted
- Your card needs verification
- A payment failed
- Your account information needs updating
- You are entitled to a refund
The message then provides a link.
That is exactly the moment to stop.
Do not use the link.
Open your banking app or use the bank’s known website and check your account there.
The FTC warns that phishing messages commonly impersonate banks and other trusted companies to convince people to provide financial or account information. (Consumer Advice)
When money is involved, verification should happen through a channel you initiated.
What to do when an email feels suspicious
You do not have to determine with absolute certainty that an email is malicious before taking precautions.
If something feels wrong, stop interacting with it.
Do not click the link.
Do not open the attachment.
Do not reply with information.
Do not call a phone number included in the message.
Instead, verify the request independently.
If it is clearly phishing, report it through the reporting tools available in your email service or organisation, then delete it according to your normal security process.
Reporting matters, particularly in workplaces. CISA recommends that organisations train users to identify suspicious messages and report phishing attempts, including cases where someone has already opened a suspicious email, link or attachment. (CISA)
A suspicious email reported by one employee can help protect everyone else.
What if you already clicked?
Do not panic.
What you should do depends on what happened.
If you clicked a suspicious link but did not enter information or download anything, close the page and report the message.
If you entered your password, change it immediately through the legitimate service. If you used that password elsewhere, change it there too.
Enable multi-factor authentication on the affected account if it is available. The FTC notes that MFA can make it harder for an attacker to access an account even if they obtain a username and password. (Consumer Advice)
If you downloaded or opened a suspicious file, run your security software and follow your organisation’s incident reporting process if the device belongs to your workplace.
The most important thing is to report the incident quickly rather than hide it because you are embarrassed.
Phishing is designed to make people act before they think.
Anyone can make a mistake.
The five-second phishing test
You do not need to become an expert at reading email headers.
Start with five questions:
1. Was I expecting this email?
2. Does the sender’s actual address make sense?
3. Is it asking me to click, download, pay or share information?
4. Is it creating unusual urgency or pressure?
5. Can I verify the request somewhere else?
If any of those answers make you uncomfortable, stop.
Verify first.
That tiny pause can be more useful than trying to memorise every type of phishing scam.
Phishing in 2026 requires a slower inbox
The biggest change is not that phishing has become impossible to spot.
It is that you can no longer rely on obvious mistakes to protect yourself.
A convincing logo does not prove an email is real.
A familiar name does not prove the sender is genuine.
Good grammar does not prove the message is safe.
Personal details do not prove the request is legitimate.
And an urgent problem does not become real simply because an email says it is.
The safest habit is simple: pause, inspect and verify.
Look at the sender. Check the destination of links. Treat unexpected attachments carefully. Ignore pressure to act immediately. And when a request involves money, passwords or sensitive information, verify it through a channel you already trust.
That is how to spot phishing email in 2026.
Not by becoming suspicious of every message in your inbox, but by refusing to let an unexpected email make an important decision for you.
