Phishing is a scam where criminals pretend to be someone you trust — your bank, a delivery company, your boss, or even a friend — to trick you into giving away passwords, money or personal information. It’s the most common way accounts get hacked, and today it arrives not just by email but by SMS, WhatsApp, social media and phone calls. Learning to spot a phishing email is one of the most useful online safety skills.
Tested by Ayzaz Khan: I followed the steps in this guide on my Lenovo ThinkPad (Intel Core i7, 5th generation) running Windows 11 and on my iPhone 14 Pro Max, and they worked as described. Last checked: September 2026.
The good news is that most phishing attempts share the same warning signs. Once you know them, you’ll spot scams in seconds.
What Phishing Looks Like Today
- Email phishing: Fake messages from banks, streaming services or online stores asking you to “verify your account.”
- Smishing (SMS phishing): Texts about a failed delivery, unpaid bill or prize, with a link to click.
- WhatsApp and social media scams: Messages from a “friend” whose account was hacked asking for money or a verification code.
- Vishing (voice phishing): Phone calls from fake bank or tech-support staff asking for OTP codes or remote access to your device.
10 Warning Signs of a Phishing Message
1. It Creates Urgency or Fear
“Your account will be suspended in 24 hours!” “Unusual activity detected!” Scammers want you to act before you think. Real companies rarely demand immediate action through a link.
2. The Sender Address Is Slightly Off
Look closely at the actual email address, not just the display name. Scammers use lookalike domains such as paypa1.com, amaz0n-support.net or a random Gmail address pretending to be a company.
3. The Link Doesn’t Go Where It Claims
On a computer, hover your mouse over a link to see the real address before clicking. On a phone, press and hold the link to preview it. If the domain doesn’t match the real company’s website, don’t open it.
4. It Asks for Passwords, OTPs or Card Details
Legitimate banks and services will never ask you to share your password, PIN or one-time code by email, SMS or phone. Anyone asking for an OTP is almost certainly a scammer.
5. Generic Greetings
“Dear customer” or “Dear user” instead of your name can be a sign of a mass-sent scam — though some phishing messages do include your name, so don’t rely on this alone.
6. Unexpected Attachments
Invoices, “shipping documents” or ZIP files you weren’t expecting can contain malware. Don’t open attachments unless you’re sure who sent them and why.
7. Too Good to Be True
Lottery wins, free phones, job offers with huge salaries for little work, or investment returns that are “guaranteed” — these are classic bait.
8. Spelling and Design Mistakes
Poor grammar, odd formatting and blurry logos can be clues. However, modern scams are often well written, so a polished message isn’t proof of safety.
9. Requests for Unusual Payments
Requests to pay with gift cards, cryptocurrency or wire transfers to a new account are major red flags, especially when combined with urgency.
10. A “Friend” Asking for a Code
If a contact messages you saying “I sent you a code by mistake, please forward it,” don’t. That code is usually the key to taking over your account.
What to Do If You Receive a Suspicious Message
- Don’t click links or open attachments.
- Verify independently. Open the company’s official app or type its website address yourself. Call your bank using the number on the back of your card.
- Report it. In Gmail, open the message, tap the three-dot menu and choose Report phishing. In WhatsApp, you can report and block the contact.
- Delete it.
What to Do If You Already Clicked
Don’t panic — act quickly:
- If you entered a password, change it immediately, and change it on any other site where you used the same password.
- Turn on two-factor authentication for that account.
- If you shared card or bank details, contact your bank right away to block the card.
- Run a security scan on your computer or phone.
- Check your account’s recent activity and signed-in devices, and sign out any you don’t recognize.
Troubleshooting: Common Problems and Fixes
You’re not sure whether a message is real
Don’t use any link or phone number in the message. Open the company’s official app or type its website address yourself and check there. On a computer, hover over a link to see the real address; on a phone, long-press it to preview.
You keep getting phishing emails
Report them rather than just deleting them: in Gmail, open the message, click the three dots and choose Report phishing; in Outlook, use Report → Report phishing. Don’t click “unsubscribe” in suspicious emails, as it confirms your address is active.
A real email ended up in spam
Open it from the spam folder, mark it as Not spam and add the sender to your contacts so future messages arrive normally.
Scam text messages on your phone
In Google Messages, long-press the conversation and choose Block and Report spam. On iPhone, use Report Junk under the message. Reporting helps filters catch the same scam for other people.
What We Found When Testing
We checked every warning sign in this guide against real suspicious emails and messages in our own inboxes on the ThinkPad and our iPhone 14 Pro Max. The most reliable tell was always the same: hovering over (or long-pressing) the link showed a web address that didn’t match the company it claimed to be from.
How Google Defines Phishing, and What It Will Never Ask
Google’s Gmail help page on phishing defines it as an attempt to steal personal information or break into online accounts using deceptive emails, messages, ads or sites. The warning signs it lists are behaviours, not spelling mistakes: a message that asks for personal or financial information, pushes you to click a link or download software, or impersonates an organization or a person you know. Google notes that a phishing message can look identical to a real one.
That last point is why judging a message by how professional it looks no longer works. A firmer rule comes from the same page: Gmail will never ask for your password by email. Most banks and services follow the same principle, so any message that asks for a password or a code is suspect regardless of how it looks. In Gmail you can report one from the More menu next to Reply, using Report phishing.
Phishing: Common Questions
Can I get hacked just by opening a phishing email?
Simply opening an email is usually safe on up-to-date devices. The danger comes from clicking links, downloading attachments or entering information.
Why do scammers have my name and number?
Personal data often leaks in data breaches and is sold or shared online. Having your details doesn’t make a message genuine.
Sources and further reading: FTC: How to recognize and avoid phishing scams; Gmail Help: Avoid and report phishing emails.
When in Doubt, Do Not Click
Pause before you click. If a message pressures you, asks for codes or passwords, or links to a strange address, verify it through an official channel first. That five-second pause is the most effective security tool you have. Whenever something feels urgent or unusual, treat it as a possible phishing email and verify it first.
