Phishing Emails: How to Spot, Check and Report Them

A phishing email pretends to come from someone you trust — your bank, Microsoft, a delivery company, your boss — so that you click a link, open an attachment, or hand over a password, a code or money. The US Federal Trade Commission sums up the goal simply: get you to click links or open attachments. This guide shows how to tell a fake from the real thing in under a minute, what genuine companies say they’ll never ask for, and what to do next.

Got a suspicious email right now? Paste the sender’s address into the Is This Email Real? checker, or paste the full headers into the Email Header Analyzer for a plain verdict.

The 60-second check

1. Read the address, not the name. The name shown in your inbox is just text the sender typed. Click or tap it to see the full address, then look at the part after the @. Is it a domain the company actually owns? The sender checker compares it with what Microsoft, Google, Apple, PayPal, Amazon and others publish, and spots look-alikes such as paypa1.com.
2. Check that the address wasn’t forged. A From address can be faked. Whether the email really came from that domain is recorded in its headers as a DMARC result. Copy the headers (“Show original” in Gmail) into the header analyzer — here’s how, app by app.
3. Look at what it asks for. Your password, a verification code, card details, a gift card, a payment by email. Real companies publish what they will never ask — see the table below.

If any of the three fails, don’t click, don’t reply. Go to the company yourself — type its web address or open its app — and report the email.

Warning signs, from the companies being copied

Google, Microsoft and Apple all publish the signs they see most. Between them:

• It asks for personal or financial information — a password, a card number, bank details (Google, Apple).
• It pushes you to click a link or download something (Google), or arrives unexpectedly with an attachment (Apple).
• The sender doesn’t match the company it claims to be, or wrote to an address you never gave that company (Apple). Google also suggests checking that the sender’s name and address match.
• A link looks right but goes somewhere else. On a computer, hover over a link before clicking; if the address doesn’t match the text, it may lead to a phishing site (Google, Apple).
• It looks different from the company’s usual emails (Apple) — or, the opposite trick, it looks exactly like a message from someone you trust (Google).
• It promises a reward such as a tax refund, sends a “document” you must sign in to open, or an invoice for something you didn’t buy with a “locked” attachment that asks for your email password (Microsoft’s examples).
• It’s urgent or too good to be true (Google) — an overdue invoice, a problem you must fix by confirming your card number (FTC).

Messages can also pretend to be from a person: Google warns about phishing that impersonates a family member, friend or coworker.

How fake sender addresses fool people

• Look-alike characters: a digit 1 for an L (paypa1.com), “rn” for “m” (rnicrosoft.com), or letters from another alphabet that look identical. DocuSign gives its own example: dse@docusgn.com, with the “i” missing.
• Extra words: paypal-security.com or amazon-billing.net contain the name but belong to someone else.
• The name as a subdomain: in apple.com.verify-id.info, the domain that matters is the last part, verify-id.info. Read domains from the right.
• A trusted name in front of a free address: “Apple Support” <apple.support@gmail.com>. Anyone can create an address like that.
• A trusted address in the display name itself, with a different real address behind it.

The sender checker flags all of these.

What real companies say they’ll never ask for

Each company’s published sender details and reporting address are in the official sender directory, with links to their help pages.

Checking an email from a specific company

• Is this Google security alert real?
• Is this Microsoft account security email real?
• Fake PayPal emails and invoices
• Fake Amazon emails and texts
• Fake Apple Account emails and texts

For any other company in our directory — Netflix, DocuSign, X, Dropbox, Yahoo, HMRC, the IRS — start from the official sender directory.

If you think it’s phishing

1. Don’t click its links, open its attachments or reply.
2. Check with the company directly, using a website, app or phone number you know is real — not the ones in the email. For example, Microsoft suggests checking sign-in alerts at account.microsoft.com/security, Google lists recent security activity at myaccount.google.com/notifications, and Amazon says genuine messages also appear in Message Center in your account.
3. Report it in your email app and to the company it imitates — how to report phishing.
4. Delete it. The FTC’s advice: once you’ve checked it out and reported it, delete the message.

Already clicked a link, typed a password or paid? Don’t panic — here’s what to do right now, step by step.

Make phishing less likely to work

• Turn on two-step verification (two-factor authentication) for your email and important accounts. The FTC recommends it, and Google notes it protects your account even if your password is stolen.
• Use a different password for every account, so one stolen password doesn’t open the others.
• Go to sites yourself. Bookmark your bank and the accounts you use, rather than signing in from email links.