How to spot a phishing email before you click

A few signs are all it takes to tell a fraudulent email from a legitimate one. Here are the ones we see most often.

Phishing remains the most common entry point for password theft, financial fraud and attacks on businesses. You don't need to be a security expert to spot it: paying attention to a few details is enough to catch most attempts before they cause any damage.

The sender is almost never who they claim to be

Look at the full address, not just the display name. An email claiming to be from a bank but arriving from an odd domain, with swapped letters or strange extensions, is already suspicious. Attackers often use variations very close to the real domain: an extra letter, a hyphen, a different ending.

The message wants you to act fast

"Your account will be blocked in 24 hours", "urgent pending payment", "verify your details now". Urgency is a classic tool to stop you from pausing to think. When an email pushes for immediate action out of all proportion, you should be suspicious.

The links don't go where they say

Before clicking, hover over the link (without clicking) and check the real URL shown below, in your browser or email client. If the text says "bank.com" but the link points somewhere else, it's phishing.

It asks for something a legitimate company wouldn't request by email

Passwords, verification codes, full card details: no legitimate organisation asks for these by email. If a message requests them, that's a clear red flag.

Unexpected attachments are a risk

Invoices, CVs or documents you weren't expecting, especially in executable or compressed formats, are a common way to install malware. If you're not expecting that file, don't open it even if the sender looks familiar: compromised accounts also send malicious attachments.

What to do if you have doubts

• Don't click or download anything until you've confirmed the source.
• Contact the organisation or person through another channel (phone, official website) instead of replying to the email.
• If it's an email addressed to your company, notify whoever manages IT security before forwarding or deleting it.
• When in doubt, delete it. It's better to lose a wrongly flagged legitimate email than to open a fraudulent one.

No automatic filter catches one hundred percent of phishing attempts. The real risk reduction comes from combining technical tools with people who know what to look for.