How to Spot a Phishing Email Before It's Too Late
Urgency, unusual payment instructions, requests for passwords and unexpected attachments deserve caution.
- Check the request and the complete address
- Invoice and parcel messages need different checks
- Respond according to what you actually did
- Make verification easy before the next message
- Example: a supplier changes the payment account
- Keep a useful incident record
- Questions about this guide
- Further reading
- Related help
- Terms in this area
- Read next
- Tell us about your own situation.
- Services
- Resources
- Company
- Get in touch
Urgency, unusual payment instructions, requests for passwords and unexpected attachments deserve caution. A convincing phishing message can contain a real logo, correct spelling and a familiar sender name. Its purpose is to make you disclose a password, approve a payment or run a harmful file. The safest test is whether the request makes sense when checked independently. This guide separates suspicious-message checks from the actions needed after a click, a disclosed password or a payment. An urgent message is not proof of a scam, but urgency is a reason to slow down rather than skip verification. Check the request and the complete address Expand the sender details; a display name can be copied. Examine the full domain after the @ sign, without assuming a familiar word somewhere in the address makes it genuine. A compromised real account can also send phishing, so a correct sender is not conclusive. On a computer, hovering can reveal a link destination, but avoid opening links just to inspect them. On a phone, preview behaviour varies; the simpler alternative is to open the organisation’s app or a saved bookmark. Search results can contain misleading adverts too. Use a contact or address you already trust rather than the message’s telephone number. Invoice and parcel messages need different checks For an invoice, compare the supplier, purchase and bank details with your records. An unexpected change of bank account needs confirmation through an established telephone contact, even if the email conversation looks normal. Do not reply to the same thread as your only verification. For a parcel, check an order you actually placed through the retailer or carrier’s genuine app. Small redelivery charges are often used to collect card details. For an account suspension, sign in independently and look for a notice inside the account. A QR code deserves the same scrutiny as a link: it can hide the destination rather than prove authenticity. Respond according to what you actually did Opening an email is not the same as running an attachment. Write down what happened: link opened, password entered, file downloaded, file executed or payment sent. Close a suspicious page without accepting notification permissions or calling its support number. Keep the message as evidence when reporting, without forwarding a dangerous attachment to relatives. If you entered a password, change it from a trusted device using the genuine website, then review sessions, recovery details and e
Does a familiar sender name mean an email is safe?
Unfortunately not. If a request is unexpected, check it using contact details you already trust, especially when it asks for a payment, a sign-in or a verification code.
What should I do if I entered a password on a suspicious page?
Do not panic, this happens to many people. Change the password through the real service on a device you trust and take a look at who has access to the account. If money or sensitive information is involved, contact the relevant provider promptly.
Does a padlock prove the email link is safe?
Sadly, no. HTTPS protects the connection to the domain shown, and criminals can get certificates for their own domains too. Check the organisation, the request and where the link really leads, rather than trusting the padlock.