Phishing emails used to give themselves away with a strange address, bad spelling and “Dear Customer”. Some still do. But many now use real logos, mention services you actually use and read perfectly, so learning how to spot a phishing email in 2026 means checking what the email wants you to do, not how it looks.
The short version
Do not judge an email by its logo or its spelling. Check who really sent it, where its links go and what it is asking for, then confirm anything important outside the email.
- Open the sender details and check the real address. The display name can say anything.
- Hover over a link (or press and hold on a phone) to see where it really goes before you tap.
- Urgent threats about your account, a parcel or a payment are the most common hook. Ten minutes of checking rarely costs you anything.
- Never log in through a link in an email. Open the app or type the website address yourself.
- If you already clicked and typed a password, change it on the real site at once and turn on two-factor authentication.
What is a phishing email?
Phishing is a scam where someone pretends to be a company or person you trust so you will hand over something they want. The email might claim to be from your bank, your employer, a colleague, a delivery company or a streaming service. It usually wants you to:
- type your username and password into a fake page
- share card or bank details, or change where a payment goes
- open an attachment or download a file that installs malware
- approve a login, buy gift cards or send sensitive information
Scammers keep finding new covers. In May 2026, the US Federal Trade Commission warned about fake party invitations that ask you to enter your email address and password just to open them.
Check the real sender, not the name or logo
A familiar logo can make an email feel genuine in a second. Ignore it. Most email apps show only the sender’s name, and a scammer can set that name to “Your Bank” or your manager’s name. Tap or click the name to see the full address underneath.
Look closely at the part after the @. Scammers use addresses that are almost right, with one letter changed or an odd ending. If an email says it is from your employer, the address should end in your company’s domain. If it says it is from a company you use, the address should belong to that company. If it does not make sense, stop there.
Be wary of urgency
Phishing works best when you do not have time to think. Your account will be closed. Your payment failed. Your parcel cannot be delivered. You have a refund waiting. You must verify your identity today. The email creates a problem and hands you a button to fix it.
In plain terms: when an email says something must happen right now, ask what happens if you wait ten minutes. Almost always, nothing. Use those minutes to check.
Look at where links really go
A link can say one thing and take you somewhere else. On a computer, hover over it without clicking and your email app shows the real address. On a phone, press and hold the link to preview it. What matters is whether the website belongs to the company that supposedly sent the email.
If an email from your bank sends you to an unfamiliar site to “verify your account”, do not continue.
Never log in through an email link
This is the most useful habit you can build. If an email says there is a problem with your account, do not use its login button. Open the official app, type the website address yourself, or use a bookmark you already trust, then see whether the problem is real. If your bank or streaming service really needs something from you, you will find out after signing in the normal way.
The same goes for work. If “IT” asks you to reset your password, use your normal company portal or contact IT through the usual channel.
Treat unexpected attachments with care
An invoice, receipt, delivery notice or CV can carry malware. Before opening a file, ask whether you were expecting it, from this person, for this reason. If not, check with the sender another way first. Never turn on macros or “enable content” because a document tells you to.
Good spelling does not mean it is safe
Bad grammar can still be a clue, but scammers now write clean, professional emails, often with AI help. So “does this look professional?” is no longer a useful test. Look at the request instead. Does it suddenly need your password? Does it ask you to change payment details or skip the usual approval? Is there a link you were not expecting?
Personal details do not prove anything
An email that knows your name, job title or a service you use can feel real. But that information can come from your social media, a company website or an old data breach. This is called spear phishing: a scam tailored to you. A believable email still has to pass the same checks.
Unusual requests from people you know
Sometimes the email seems to come from your manager, a colleague or a friend. Their account may have been hacked, or the address may be a near copy. A common pattern starts with “Are you free? I need you to handle something quickly”, followed by a request to buy gift cards, send money or share files.
If a request is out of character, check it outside the email: call them, message them on your usual work chat or ask in person. Do not reply to the email to ask “did you send this?”, because you may be talking to the scammer.
Bank and payment emails
Emails about a suspicious login, a blocked account, a card that needs verifying, a failed payment or a refund deserve extra care, because the damage can be immediate. Do not use the link. Open your banking app or the bank’s website yourself and check there. Your bank will never ask you to share a one-time code or your PIN by email, text or phone.
What to do with a suspicious email
- Do not click links, open attachments, reply or call any number in the email.
- Check the request through a channel you trust.
- Use your email app’s Report phishing or Report spam option, then delete the message. At work, report it to IT, even if you already clicked. One report can protect the whole team.
- In the US, you can also report scams to the FTC at ReportFraud.ftc.gov.
What if you already clicked?
Do not panic, and do not hide it. What to do depends on what happened:
- You clicked but did not type anything or download anything: close the page and report the email.
- You typed your password: change it straight away on the real website or app, and anywhere else you use the same password. Then turn on two-factor authentication for that account.
- You shared card or bank details: call your bank using the number on your card or its official app, and ask it to block the card and watch for fraud.
- You opened a file: run a scan with your security software, and if it is a work device, tell IT immediately.
The five-question phishing check
- Was I expecting this email?
- Does the sender’s real address make sense?
- Is it asking me to click, download, pay or share something?
- Is it pushing me to act fast?
- Can I check this somewhere other than the email?
If any answer makes you uneasy, stop and check before you do anything. You do not need to suspect every email in your inbox. You just need to stop an unexpected one from making an important decision for you.
For the next steps, see how to secure every account you own in one afternoon.
