How to Spot Phishing Emails: Red Flags, Real Examples and What to Do

Phishing emails are fraudulent messages that impersonate a trusted person or organization to trick you into revealing passwords, paying money, or installing malware. You spot them by checking the real sender address, inspecting where links actually point, treating unexpected attachments and urgent requests with suspicion, and verifying anything important through a channel you already trust rather than through the email itself.

This guide goes beyond the usual "look for typos" advice. You will learn which red flags really matter, how modern phishing campaigns are built, how to read the technical evidence in an email header, realistic example scenarios with annotations, and a step-by-step plan for what to do if you have already clicked.

Key takeaways

• The display name means nothing. Anyone can set it to "PayPal Support" or your boss's name. Check the actual address and its domain.
• The link destination is the strongest single signal. Read the domain from right to left: in login.paypal.com.account-verify.net, the real domain is account-verify.net.
• Pressure plus a request equals danger. Urgency, fear or excitement combined with "log in", "pay", "open" or "reply with" is the core pattern of phishing.
• Good grammar and perfect branding are no longer proof of legitimacy.
• Verify out of band. Open the app or type the website address yourself; call a known number, not one in the email.
• Passkeys and password managers stop many credential phishing attacks because they will not fill or work on a fake domain.
• Limit who has your real address. A temporary inbox from VookMail for one-off sign-ups keeps your main address off many of the lists phishers buy.

What is a phishing email?

A phishing email is a message designed to manipulate the recipient into taking an action that benefits the attacker. The action is usually one of four things: entering credentials on a fake login page, transferring money or paying a fake invoice, opening a malicious file, or revealing information that enables a later attack.

The word comes from "fishing": the attacker casts a lure and waits for someone to bite. Several variants have their own names:

• Bulk phishing: generic messages sent to huge lists, such as "Your mailbox is full" or "Your package could not be delivered".
• Spear phishing: targeted messages tailored to a specific person or organization, often using names, job titles and details gathered from social media or breach data.
• Whaling: spear phishing aimed at executives or people with authority over money and systems.
• Business email compromise (BEC): attackers impersonate or take over an executive, supplier or colleague's account to redirect payments. Often no link or attachment is involved, just a convincing request.
• Clone phishing: a legitimate email you received earlier is copied and resent with the link or attachment swapped for a malicious one.
• Thread hijacking: attackers who have compromised a mailbox reply inside a real, existing conversation, which makes the message extremely believable.
• Quishing: phishing that uses a QR code instead of a clickable link, partly to evade link scanners and partly to move you onto a phone where URLs are harder to inspect.
• Consent phishing: instead of stealing a password, the attacker tricks you into granting a malicious app OAuth access to your mailbox or files through a genuine "Allow access" screen.

Why phishing still works

Phishing exploits human behavior, not just software. Messages are crafted to trigger quick, emotional reactions so that you act before you think. The most common psychological levers are:

• Urgency: "Your account will be closed in 24 hours."
• Fear: "Unusual sign-in detected", "Legal action pending", "Your device is infected."
• Authority: messages appearing to come from a CEO, a bank, a government agency or IT support.
• Reward or curiosity: refunds, prizes, unexpected payments, "See who viewed your profile".
• Routine: fake invoices, shared documents and delivery notices look like the dozens of real ones you get each week.
• Helpfulness: a "colleague" who urgently needs gift cards for a client or a file reviewed.

The defense is not to become paranoid about every email but to recognize the moment when a message asks you to do something sensitive, and to switch from reacting to verifying.

The red flags that actually matter

Not all warning signs are equally reliable. The table below ranks common red flags by how strongly they indicate phishing.

Red flag 1: the sender address does not match the display name

Email clients show a display name in large text and often hide the real address. The display name is free text that the sender chooses. A message that shows "Microsoft Account Team" might come from security-alert@outlook-verify-team.com or from a random compromised mailbox.

How to check: on desktop, hover over or click the sender name. On mobile, tap the sender name to expand it. Then look at the part after the @ sign. Watch for:

• Look-alike domains: rnicrosoft.com (r and n imitating m), paypa1.com (digit 1 for letter l), amazon-support.co.
• Added words: apple-id-security.com, netflix-billing.net. Brands rarely use hyphenated variants of their name for account mail.
• Different top-level domains: yourbank.co instead of yourbank.com.
• Free mail providers: a "bank" or "CEO" writing from a free consumer mailbox.
• Internationalized look-alikes: domains using characters from other alphabets that look identical to Latin letters, such as a Cyrillic "а" in place of a Latin "a". Browsers often display these in "punycode" form beginning with xn--, which is a useful tell.

Also check the Reply-To header. Some phishing uses a plausible From address but sets Reply-To to an attacker's mailbox, so your reply goes somewhere else. Many clients show the reply address when you click Reply; look before you send.

Red flag 2: the link does not go where it says

The visible text of a link and its real destination are separate. A button saying "Sign in to your account" can point anywhere. On desktop, hover over the link without clicking and read the URL shown in the status bar or tooltip. On mobile, long-press the link to preview the address, then cancel.

Read the domain correctly. A web address is structured like this:

https://subdomain.registered-domain.tld/path?query

The part that tells you who owns the site is the registered domain plus top-level domain, immediately before the first single slash. Everything to the left is a subdomain that the domain owner can set to anything. So:

• https://accounts.google.com/signin is Google.
• https://accounts.google.com.secure-login.app/signin is secure-login.app, not Google.
• https://secure-login.app/accounts.google.com/ is also secure-login.app; the brand name is just in the path.
• https://www.paypal.com@203.0.113.7/ uses the "@" trick: everything before "@" is treated as a username, and the real host is the IP address after it.

Other link warning signs: URL shorteners in messages that claim to be from a major brand, links to file-sharing or form-building services asking you to "log in to view a document", and links to IP addresses instead of names. Be aware that phishing pages are often hosted on legitimate cloud platforms, so a trusted hosting domain in the URL does not mean the page is safe; what matters is whether the domain belongs to the organization you think you are dealing with.

HTTPS and the padlock icon do not indicate a site is legitimate. They indicate only that the connection is encrypted. Free certificates are available to anyone, including phishers.

Red flag 3: it asks for something no legitimate sender asks for by email

Some requests are almost never legitimate in an email:

• Your password, PIN, or the one-time code you just received by SMS or app.
• Your full card number with security code.
• Payment by gift card, cryptocurrency or wire transfer to a new account.
• Remote access to your computer for a problem you did not report.
• Confidential files or employee data sent to an external address "for an audit".

The one-time code request deserves attention. Attackers who already have your password may trigger a login, which sends you a code, and then email or message you pretending to be support, asking you to "confirm" the code. Anyone asking for a code you received is trying to sign in as you.

Red flag 4: an unexpected attachment

Attachments deliver malware or lead to credential theft. Higher-risk formats include:

• Archives (.zip, .rar, .7z, .iso, .img) that hide executables from scanners.
• HTML or HTM files, which open a local fake login page in your browser without visiting a suspicious URL first.
• Office documents asking you to "Enable Content" or "Enable Editing", which activates macros.
• Double extensions like invoice.pdf.exe, made worse when the system hides known extensions.
• Script and shortcut files such as .js, .vbs, .lnk, .bat.
• PDFs containing only a button or QR code that leads to a login page.

If you were not expecting a file, verify with the sender through another channel before opening it.

Red flag 5: the context does not fit

Ask a few questions. Do I have an account with this company? Did I order anything? Does this colleague usually write like this, at this hour, about this topic? Does my bank address me by my full name in emails? A shipping notice for a parcel you never ordered or an invoice from a supplier you do not use is a strong signal by itself.

Real-world phishing examples, annotated

The scenarios below are composite examples based on common, widely documented campaign patterns. Names and domains are illustrative.

Example 1: the account suspension notice

From: "Account Security" <no-reply@secure-acct-center.com>
Subject: Action required: unusual sign-in activity

We detected a sign-in attempt from a new device. To keep your account active, verify your identity within 24 hours. [Verify now]

What gives it away: the sender domain is generic and does not belong to any service; the message does not name your account or service specifically; there is a 24-hour threat; the button leads to a login page on an unrelated domain. Safe response: open your service's app or type its address, check the security or recent activity page there. If there was no alert inside the real account, the email was fake.

Example 2: the shared document

From: "Jordan (via Docs)" <jordan.m@partnerfirm-mail.com>
Subject: Jordan shared "Q3 Payment Schedule" with you

Open in Docs

What gives it away: it imitates a genuine sharing notification, but the sender is an external address you do not know, and clicking leads to a page that asks you to sign in with your email password, often presenting a list of provider logos. Genuine sharing notifications come from the platform's own domain and open the file in a session you are already signed into. Safe response: if you know a Jordan, ask them directly. Never type your password into a page reached from a "shared file" email.

Example 3: the supplier bank change (BEC)

From: "Accounts Receivable" <ar@supplier-co.com>
Subject: RE: Invoice 4471

Please note our banking details have changed due to an audit. Kindly use the attached new account details for this and future payments. The payment is overdue so please process today.

What gives it away: this one may contain no link at all and may even come from the supplier's real, compromised mailbox inside a real thread. The red flag is the request itself: a change of payment details by email, plus urgency. Safe response: call the supplier on a phone number you already have on file, not one in the email or its signature, and confirm the change before paying.

Example 4: the parcel delivery fee

Subject: Your parcel is on hold: customs fee unpaid

We attempted to deliver your package. A small fee is required to reschedule. Pay now to avoid return to sender.

What gives it away: unexpected delivery, small fee to lower your guard, card details requested on a page not owned by a known courier. The real goal is your full card details, which can then be used for larger fraud. Safe response: track the parcel using the tracking number from the retailer's own order page or the courier's official app.

Example 5: the CEO gift card request

From: "Sam Rivera (CEO)" <sam.rivera.office@freemail.example>
Subject: quick favor

Are you available? I need you to handle something discreetly for a client. I'm in meetings, so email only.

What gives it away: personal free-mail address, secrecy, "email only", and the follow-up will ask for gift card codes. Safe response: contact the executive through the company directory, chat or phone. Report to IT.

Example 6: the QR code login

Subject: Multi-factor authentication update required

Your MFA settings expire today. Scan the QR code below with your phone to re-register.

What gives it away: MFA settings do not "expire" via email; the QR code moves you to a phone, where it is harder to inspect the URL and corporate protections may not apply. Safe response: do not scan. Check with your IT team or your account's security settings directly.

Example 7: the refund that needs your details

Subject: You are eligible for a tax refund

After the annual calculation of your activity, you are eligible to receive a refund. Submit the form within 48 hours.

What gives it away: government tax agencies in many countries state that they do not request personal or payment details via unsolicited email. The form asks for identity and card information. Safe response: log in to the official government portal by typing its address, or contact the agency by its published phone number.

How to check an email's headers

When you are unsure, the message headers contain technical evidence about where an email came from. Most clients let you view them: look for options like "Show original", "View message source" or "View message details".

The authentication results

Three standards help receiving servers verify a sender:

• SPF (Sender Policy Framework) lets a domain publish which servers are allowed to send mail for it. The receiver checks whether the sending server's IP is on that list.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the message. The receiver checks it against a public key published in the signing domain's DNS, which proves the signed parts were not altered and that the signing domain took responsibility for the message.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the domain shown in the visible From address (called alignment) and tells receivers what to do when checks fail: nothing, quarantine, or reject.

In the header, look for a line beginning Authentication-Results:. It may look like this:

Authentication-Results: mx.example.net; spf=pass smtp.mailfrom=bank.com; dkim=pass header.d=bank.com; dmarc=pass header.from=bank.com

Here every check passes and the domains align with bank.com. A spoofed message might show dmarc=fail, or show a pass for a completely different domain than the one in the From line.

What authentication can and cannot tell you

The key lesson: authentication tells you who sent the message, not whether they are honest. Combine it with the domain check. A perfectly authenticated email from paypal-resolution-center.com is still phishing.

The Received chain

Received: lines record each server the message passed through, newest at the top. Reading them can show that a "local bank" email originated from an unrelated server. This takes practice and the lines can be partially forged below the point where your provider received the message, so trust only the entries added by your own provider's servers. For most people, the Authentication-Results line and the domain check are enough.

Phishing on mobile: extra precautions

Phones make phishing harder to spot. Screens are small, sender addresses are hidden by default, and URL previews require a long-press. On mobile:

1. Tap the sender name to reveal the full address before trusting a message.
2. Long-press links to preview them; do not tap directly.
3. Prefer the official app over email links for banks, shops and social networks.
4. Be extra wary of QR codes in emails, since you scan them with the same phone you are reading on, defeating desktop security tools.
5. Remember that SMS and messaging apps carry the same tricks (often called smishing), and voice calls can follow up an email to make it more convincing (vishing).

What to do with a suspicious email

1. Do not click, download, scan or reply. Pause.
2. Check the sender address and link destinations using the methods above.
3. Verify independently. Open the official app or type the website address. Call a phone number from the back of your card, an invoice you already have, or the company directory.
4. Report it. Use your provider's "Report phishing" option, which helps train filters. At work, use the report button or forward it to your security team as they instruct.
5. Report to the impersonated organization. Many brands publish a phishing reporting address on their security page.
6. Use national reporting channels where available: in the US, the FTC accepts reports at reportfraud.ftc.gov; in the UK, the NCSC's service accepts forwarded emails at report@phishing.gov.uk; the Anti-Phishing Working Group accepts reports at reportphishing@apwg.org.
7. Delete it once reported.

What to do if you already clicked

Clicking is common and fixable. Act quickly and in this order based on what happened.

If you clicked but entered nothing

• Close the tab. Do not download anything the page offered.
• Make sure your browser and operating system are updated.
• Run a scan with your security software if anything downloaded automatically.
• Watch for follow-up messages; your click may have confirmed your address is active.

If you entered a password

1. Go to the real site by typing its address and change the password immediately.
2. Change it anywhere else you used the same or a similar password.
3. Sign out of all sessions from the account's security settings; many services offer "sign out everywhere".
4. Turn on two-factor authentication, preferably an authenticator app, passkey or security key.
5. Check for changes the attacker may have made: recovery email and phone, mailbox forwarding rules and filters, connected apps, and new devices.
6. If it was a work account, tell your IT team immediately. Speed matters because attackers often use a compromised mailbox to phish your colleagues within minutes or hours.

If you entered an MFA code or approved a prompt

Assume the attacker may have an active session. Change the password, sign out all sessions, review security settings, and alert IT if it is a work account. Modern "adversary-in-the-middle" phishing kits relay your login in real time to the real site and capture the session cookie, which is why one-time codes alone do not stop them, but passkeys and hardware security keys do, because they check the real domain.

If you entered payment details

Contact your bank or card issuer immediately using the number on your card. Ask them to block the card and watch for fraudulent transactions. Review statements for the following weeks.

If you opened an attachment or enabled macros

Disconnect the device from the network if you suspect malware, run a full security scan, and at work, contact IT before doing anything else. Change important passwords from a different, clean device.

If you granted an app access

Go to your account's security settings, find the list of third-party apps with access, and remove the unknown app. Then change your password as a precaution and check mailbox rules.

Defenses that make phishing far less effective

Spotting phishing is a skill, but good setup means a single mistake does less damage.

Why the password manager trick works

A password manager stores the exact domain where each password belongs. If you land on paypa1-secure.com and your manager offers no saved login, that silence is a red flag. Do not override it by copying and pasting the password manually. This one habit catches phishing pages that look pixel-perfect.

Shrink your phishing surface with disposable addresses

Phishers send to addresses they have bought, scraped, or pulled from breach data. Every time you give your real address to a low-trust site, it may eventually end up on one of those lists. Using a separate address for one-time sign-ups reduces how often your main inbox is targeted.

With VookMail, an address is ready as soon as the page loads, with no registration or password. You can choose your own username and one of about 31 domains, or press the yellow shuffle button for a random one. The inbox updates in real time, and messages and attachments are deleted automatically after about one day. If that address later receives phishing, it lands somewhere disconnected from your bank, work and main accounts, and then disappears.

Use temporary addresses only for one-off, low-importance sign-ups such as downloading a resource, testing a newsletter form, or a single forum question. Do not use them for accounts you need to keep or recover, and never for banking, government, healthcare, work or primary social accounts. Read the FAQ for more on appropriate use.

A note on phishing that arrives in a temporary inbox

The same red flags apply in any inbox, including a disposable one. If a message in a temporary inbox asks you to log into your real bank or email account, it is almost certainly phishing, because you never gave those services that address. Do not click it.

Common mistakes people make with phishing

• Trusting the padlock. HTTPS means encrypted, not honest.
• Trusting the display name or logo. Both are trivially faked.
• Relying on grammar. Many campaigns are now well written.
• Calling the number in the email. It goes to the attacker.
• Replying to ask "is this real?" The reply goes to the attacker, who will say yes.
• Forwarding the email to colleagues to ask instead of using the report process, which spreads the lure.
• Not reporting after clicking out of embarrassment, which gives attackers more time.
• Thinking "I have nothing worth stealing." Your mailbox can reset every other account and can be used to phish your contacts.

Quick phishing checklist

Run through this list whenever an email asks you to do something.

1. Was I expecting this message?
2. Does the real sender address belong to the organization it claims?
3. Where do the links really go? Read the domain right to left.
4. Is it asking for a password, code, payment or file?
5. Is it pushing urgency, fear, secrecy or a reward?
6. Is there an unexpected attachment, QR code or "enable content" prompt?
7. Does my password manager recognize the login page?
8. Can I verify it by opening the app or calling a known number instead?

If any answer worries you, stop and verify. Verifying costs a minute; a successful phish can cost far more.

Frequently asked questions

What is the easiest way to spot a phishing email?

Look at where the email wants to take you and what it wants you to do. Hover over links to see the real destination domain, check the sender's actual address rather than the display name, and be suspicious of any message that pressures you to log in, pay, or open an attachment urgently.

Can I get hacked just by opening a phishing email?

With an up-to-date email client, simply opening a message is generally low risk. The danger comes from clicking links, entering credentials, opening attachments, enabling macros, or replying with information. Opening an email can, however, confirm to the sender that your address is active if images load.

What should I do if I clicked a phishing link?

If you entered nothing, close the page and run a security scan. If you entered a password, change it immediately on the real site and anywhere you reused it, sign out other sessions and turn on two-factor authentication. If you entered payment details, contact your bank or card issuer right away.

Why do phishing emails pass spam filters?

Attackers register new domains, send from compromised legitimate accounts, use trusted cloud services to host pages, and change wording constantly. Some phishing even passes SPF, DKIM and DMARC because it is sent from a domain the attacker genuinely controls, so authentication proves who sent it, not that the sender is honest.

How do I report a phishing email?

Use your email provider's Report phishing option, tell your IT team if it reached a work account, and report to the impersonated company. National channels also exist, for example the FTC at reportfraud.ftc.gov in the US, report@phishing.gov.uk in the UK, and reportphishing@apwg.org for the Anti-Phishing Working Group.

Does a disposable email address protect me from phishing?

It reduces exposure. If you give a temporary address to low-trust sites, phishing aimed at that leaked address lands in an inbox that auto-deletes and is not connected to your real accounts. It does not replace checking links and senders in your main inbox.

Are phishing emails always full of spelling mistakes?

No. Many modern phishing emails are well written and visually identical to real brand emails, especially now that attackers can use translation and writing tools. Focus on technical signals and requests rather than grammar alone.

To learn how VookMail handles incoming messages and your data, see the privacy policy, or explore more email security guides on the VookMail blog.