A phishing email tries to make you hand over information, pay money or open something dangerous by pretending to be a company or person you trust. It may look like a delivery notice, a bank warning, an invoice or a message from your manager.
Modern scams can have perfect spelling and convincing logos. Instead of judging the design, check what the message asks you to do and verify the request through a separate, trusted channel.
Step 1: Pause when a message creates urgency
Warnings such as 'your account closes today', unexpected refunds and demands for immediate payment are designed to rush you. An urgent tone is a warning sign, not proof by itself.
Do not reply, pay or share information until you have checked the request. Be especially cautious about password requests, one-time login codes, gift cards, cryptocurrency and unexpected changes to bank details.
Step 2: Check the actual sender address
Expand the sender details to see the full email address, not just a name such as 'Microsoft Support'. Look for misspelled domains, extra words or a Reply-To address that differs unexpectedly.
Even a correct-looking address does not guarantee safety: sender details can be forged and real accounts can be compromised. A familiar sender asking for unusual payment or files still needs an independent check.
Step 3: Avoid the link and open the service yourself
On a computer, hovering over a link can reveal its destination without clicking. Check the actual domain carefully: in 'bank.example.com', the domain is example.com, not bank. HTTPS and a padlock only mean the connection is encrypted; scam websites can have them too.
The safest response to an account warning is to open the company's app or use a bookmark you already trust. Check your account there instead of following the email link. Treat QR codes like links: they can lead to the same fake sign-in pages.
- Do not use the phone number supplied in a suspicious email. Find the number in the official app, on your card or on a trusted statement.
- On a phone, avoid tapping a link just to inspect it. Some long-press menus also load previews; opening the service independently is safer.
Step 4: Be careful with attachments and shared files
An unexpected invoice, ZIP archive, document or shared-file invitation deserves a check before opening. Contact the sender using a known number or a new message to their saved address.
Never enable macros, turn off antivirus protection or install software just to read an attachment. PDFs and cloud-document links are not automatically safe either; they may contain fake payment instructions or sign-in links.
Step 5: Report the message, then delete it
Use your email service's Report phishing option, usually in the message menu. At work, follow your organisation's reporting process so the security team can check whether other people received the same message.
Do not reply to ask whether the email is real, and do not use an unsubscribe link in a suspicious message. Report it and remove it after any necessary workplace checks.
If you already clicked or shared information
- Only opened a page? Close it, do not grant permissions or download anything, and check for unexpected downloads. A click alone does not necessarily mean your account was compromised.
- Entered a password? Open the real service independently and change it immediately. Change it anywhere else you reused it, review recovery details and sign out unknown sessions.
- Shared a login code or approved a sign-in? Treat the account as potentially compromised. Use its official recovery process and check linked devices, forwarding rules and recent activity.
- Shared card details or paid? Contact your bank immediately using its official app or a trusted number. Ask about blocking the card or recovering the payment.
- Opened or ran a suspicious download? Stop using the device for sensitive accounts. Run a full scan with its trusted security software; contact your workplace security team if it is a work device.
Tips and tricks that reduce the risk
- Keep your browser, operating system and email app updated, and leave built-in security protection enabled.
- Use a password manager and enable two-factor authentication. A password manager failing to recognise a website is a useful warning sign, though not a guarantee.
- Confirm changed bank details with a known contact before sending money, even when the request arrives in a genuine email thread.
- Never send passwords or recovery codes to anyone claiming to be support. Verify sign-in requests you did not initiate rather than approving them.
The best habit is simple: leave the email and check the request somewhere you already trust. You do not need to prove an email is fake before deciding not to use its links.
For help with a suspicious message, use Digital Checkup. Remove personal information and do not include passwords, codes or active sign-in links.