Spot a Phishing Email in 60 seconds

What is Phishing?

Phishing is when someone sends you a fake email pretending to be someone you trust (bank, school, Spotify). The goal is to trick you into clicking a link, opening an attachment, or handing over a password.

It's the most common cyberattack on the planet. And you can spot one in under a minute.

The 60-Second Checklist

Every phishing email has tells. Run through these 4 checks before you click anything.


1. Who Is It Actually From?


Look at the sender's email address - not the display name, the actual address.

example 
From: Netflix Support -> netflix-support@gmail.com
                        ^^^^^^^^^^^^^^^^^^^^^^^^^
                Not @netflix.com — this is a Gmail address

Legitimate companies don't use @gmail.com, @yahoo.com, or @outlook.com. Netflix sends from @netflix.com. Your bank sends from their own domain. Always.


2. Are They Pressuring You?


Phishing emails create false urgency:


3. Where Does That Link Actually Go?


Hover your mouse over any link or button. Do not click it. Look at the bottom-left corner of your browser — the real URL appears there.

example 
What you see:  https://www.netflix.com/account
Where it goes: http://netf1ix-verify.ru/login
                      ^^^^^^^^       ^^
                      Lookalike      Russian domain

Attackers use lookalike domains: netf1ix.com (one instead of L), paypa1.com (one instead of L), amaz0n.com (zero instead of O).


4. Are There Weird Mistakes?


Real companies have editors. Phishing emails often have:

None of these are proof alone. But together with the other checks, they paint a clear picture.

A Real Example

Here's what a typical phishing email looks like. Every element is designed to trick you.

From: PayPal Service paypal@secure-accounts.net Subject: URGENT: Your account has been limited

Dear Customer,

We detected unusual activity on your PayPal account. To prevent permanent closure, verify your identity immediately by clicking the link below.

Verify My Account →

Failure to verify within 24 hours will result in account suspension.

Regards, PayPal Security Team

Red flags in this email:

Every single one of these is a deliberate psychological trick. Now you can spot them.

Go Deeper: Check the Email Headers


Every email carries hidden metadata called headers. They show the actual path the email took to reach you. If the headers don't match the sender, it's fake.

In Gmail: Open the email → three dots (top-right) → Show original.

In Outlook: Open the email → three dots → View message source.

Look for these lines:

email headers 
Return-Path: scammer@evil-domain.ru

Received: from mail.evil-domain.ru (evil-domain.ru [192.168.1.1])
Authentication-Results: spf=fail smtp.mailfrom=evil-domain.ru

What to look for:

You don't need to memorize these. Just know that headers exist and that fail is bad.

How to Safely Inspect a Suspicious Link

If you're curious where a link goes but don't want to click it:

bash 
curl -I http://paypa1-secure.com/login

What each part does:

This shows you where the link actually leads — what server responds, whether it redirects somewhere else — without ever rendering the page or exposing your browser.

What To Do If You Spot a Phishing Email

If you haven't clicked anything:

  1. Don't click any links. Don't open attachments.
  2. Report it using your email provider's "Report phishing" button.
  3. Delete it.

If you already clicked the link but didn't enter anything:

  1. Close the page immediately.
  2. Run a malware scan (Windows Defender or Malwarebytes).
  3. You're probably fine — most phishing pages only work if you type in your password.

If you entered your password on a phishing page:

  1. Change that password immediately on the real website.
  2. Enable multi-factor authentication (MFA) if you haven't already.
  3. Check for unfamiliar logins in your account settings.
  4. If you reused that password anywhere else, change it there too.