SKILL SOURCE • ONLINE SAFETY
How to Spot a Phishing Email Before It Tricks You
Learn how phishing messages work, which warning signs to look for,
and what to do when an email, text, or online message seems suspicious.
What Is Phishing?
Phishing is a type of online scam in which someone attempts to
deceive you into revealing information, clicking a harmful link,
opening an unsafe attachment, transferring money, or taking another
action that benefits the attacker.
Phishing messages can arrive through email, text messages, social
media, messaging applications, websites, and other communication
channels.
The important lesson:
A message can look professional and still be fraudulent. Learn to
verify the request rather than trusting its appearance.
WARNING SIGNS
7 Signs a Message Could Be Phishing
No single warning sign proves that a message is fraudulent, but several
unusual signs together should make you stop and investigate.
01
Unexpected Urgency
The message pressures you to act immediately.
02
Suspicious Link
A link may lead somewhere different from what you expect.
03
Sensitive Request
You are asked for passwords, codes, banking details, or other sensitive information.
04
Unexpected Attachment
The message contains a file you were not expecting.
05
Strange Address
The sender address may not match the organization it claims to represent.
06
Unexpected Payment
You are suddenly instructed to pay, transfer, or purchase something.
07
Unusual Request
Someone asks you to bypass normal procedures or secrecy.
CHECK THE DETAILS
Look Carefully at the Sender
A phishing message may use a familiar company name or logo, but the
actual sender address can reveal something unusual.
Do not judge a message only by the name displayed in your inbox.
Look at the actual address and consider whether it makes sense for
the organization or person supposedly sending it.
Remember:
A familiar-looking sender name does not automatically prove that
the message is legitimate.
Be Careful With Links
Phishing campaigns frequently use links to direct people to websites
designed to collect information or perform other unwanted actions.
Before following an unexpected link, consider whether you actually
need to use it. If a message claims that you need to sign in to an
account, it can be safer to open the service through its official
application, a bookmark you already trust, or an address you enter
yourself rather than relying on the unexpected message.
Stop
Do not click automatically.
Verify
Check what the message is asking you to do.
Navigate Safely
Use a trusted route to reach the service.
DON’T PANIC
Be Suspicious of Pressure and Fear
Scammers may use fear, urgency, curiosity, or excitement to encourage
people to act before thinking.
Messages may claim that an account will be closed, a payment failed,
a package is waiting, an unusual login occurred, or an important
opportunity will disappear unless you act immediately.
Give Yourself Time
If a message makes you feel rushed, stop and verify the situation
independently before doing anything.
Think Before Opening Attachments
Unexpected attachments can present security risks. A file may appear
to be an invoice, document, image, delivery notice, or other ordinary
item while actually containing something harmful.
If you were not expecting a file, verify it with the sender through
a separate trusted communication method before opening it.
How to Verify a Suspicious Message
1
Stop
Do not immediately click, reply, pay, or provide information.
2
Check
Examine the sender, request, links, timing, and context.
3
Verify
Contact the organization or person through a trusted channel.
4
Report
Use the appropriate reporting tools when you identify a phishing attempt.
IF YOU MADE A MISTAKE
What If You Already Clicked?
Accidentally clicking a suspicious link does not necessarily mean that
your account has been compromised. What matters is what happened next.
If you entered a password or other sensitive information into a
suspicious website, take the situation seriously. Consider changing
the affected password through the legitimate service and review
available account-security options.
Act quickly, but don’t panic.
Secure the affected account, review activity, and use the legitimate
provider’s security and recovery guidance.
The 30-Second Phishing Test
Before acting on an unexpected message, ask yourself these questions:
Is this message expected?
Does the request make sense?
Do I recognize the sender?
Is the message creating unnecessary urgency?
Is it asking for sensitive information?
Can I verify the request independently?
Stop. Think. Verify.
Phishing attacks often depend on human reactions rather than technical
weaknesses. Taking a few moments to examine an unexpected message can
help you avoid making a costly mistake.
Make verification a habit, especially when a message involves passwords,
financial information, security codes, payments, or urgent account actions.
SKILL SOURCE
Learn Skills That Help You Stay Safer Online
Explore more practical guides covering cybersecurity, computers,
artificial intelligence, internet safety, coding, and digital skills.
Educational Notice:
This article provides general cybersecurity education and does not replace
guidance from your email provider, financial institution, employer,
security provider, or other relevant service.
