Phishing6 min readPublished 18 June 2026 · Updated 21 September 2026
How to Spot a Phishing Email: The Complete Guide
Learn practical checks for suspicious sender addresses, urgent language, links, and attachments — and safer next steps if an email worries you.
A phishing email can look professionally written and still be dangerous. The useful question is not whether the branding looks right; it is whether the sender, destination, and requested action can be verified independently without using the email’s own links.
What Is a Phishing Email?
A phishing email impersonates a trusted organisation — a bank, a delivery company, HMRC, Amazon, PayPal, or even your employer — to trick you into taking an action that benefits the fraudster. The email typically creates urgency: your account has been compromised, a payment has failed, a parcel is waiting, or you owe money.
How to Spot a Phishing Email
| What to Check | What to Look For |
|---|---|
| Sender address | Does it match the real domain? (e.g. support@paypa1.com is not PayPal) |
| Greeting | Generic ("Dear Customer") vs. your real name |
| Urgency | Pressure to act immediately is a major red flag |
| Links | Hover over links — does the URL match the claimed sender? |
| Attachments | Unexpected attachments, especially .zip, .exe, or .doc files |
| Grammar | Poor spelling and grammar (though modern AI-generated phishing is often flawless) |
Spear Phishing: Targeted Attacks
Spear phishing is a more sophisticated variant where the attacker researches their target and personalises the email. They may use your name, your employer's name, or reference a recent transaction. These are much harder to detect and are commonly used in business email compromise (BEC) attacks.
What to Do With a Suspicious Email
Do not click any links or download any attachments. If the email claims to be from a company you use, go directly to that company's website by typing the address in your browser. Report phishing emails to the NCSC at report@phishing.gov.uk. If you clicked a link, change your passwords immediately and check your accounts for suspicious activity.
Check the risky parts separately
Copy the sender address and each link into ScammersCheck one at a time. Never open an attachment to obtain its URL, and remove names, account numbers, signatures, and message text that are not needed. A clean result is not a guarantee, so still sign in through the organisation’s known website.
Source note: The verification steps are aligned with the NCSC phishing guidance and GOV.UK reporting guidance. Poor grammar is not required for an email to be phishing.
Received a suspicious email? Paste the sender's email address or any links into ScammersCheck for an instant threat check.
Check anything suspicious instantly
Paste a phone number, URL, email address, or suspicious message — get an input-aware risk indicator with transparent evidence and limitations. No signup required.
Check Now — It's Free