How to Spot Phishing Emails: 10 Warning Signs and What to Do (2026 Guide)

Phishing is one of the most common ways attackers steal passwords, money, and data. The emails look real, and anyone can be fooled on a busy day. This guide gives you 10 warning signs to check and a clear plan if you already clicked something suspicious.

What Is Phishing?

Phishing is a scam where an attacker pretends to be a trusted company or person, such as a bank, delivery service, or your boss, to trick you into clicking a link, opening a file, or sharing sensitive information.

10 Warning Signs of a Phishing Email

1. Urgent or threatening language. "Your account will be closed in 24 hours" is designed to make you panic.
2. Mismatched sender address. The display name says "Your Bank," but the address is a random or slightly misspelled domain.
3. Suspicious links. Hover over a link (do not click) and compare the real address with what the text says.
4. Generic greeting. "Dear customer" instead of your real name.
5. Requests for sensitive data. Legitimate companies do not ask for passwords, OTPs, or card PINs by email.
6. Unexpected attachments. Be careful with invoices, "scanned documents," and zip files you did not expect.
7. Too good to be true. Surprise prizes, refunds, and job offers are classic bait.
8. Poor formatting or odd wording. Not always present, since attackers now write convincing text.
9. Unusual requests from "your boss." Gift cards or urgent payments requested by email should always be confirmed by phone.
10. Login pages that look slightly off. Check the address bar before typing your password.

Example of a Fake Email

What to Do If You Clicked

1. Disconnect from the network if you opened a suspicious file.
2. Do not enter any more information on the page.
3. Change your password immediately on the real site, and on any other site where you reused it.
4. Turn on multi-factor authentication (MFA) for important accounts.
5. Run a malware scan with your security software.
6. Contact your bank right away if you shared card or banking details.
7. Report it. Use your email provider's "Report phishing" option. In India, you can report cyber fraud at cybercrime.gov.in or call the helpline 1930. Elsewhere, use your country's official cybercrime reporting service.

How to Protect Yourself

• Use a password manager so each site has a unique password.
• Enable MFA, preferably with an authenticator app or passkey.
• Type website addresses yourself or use bookmarks for banking.
• Keep your system and browser updated.
• Pause before clicking. Verify through a separate channel.

These habits are part of good cyber hygiene, and a secured network helps too. See How to Secure Your Home WiFi.

Frequently Asked Questions

Can I get hacked just by opening a phishing email? It is rare, but possible in some cases. The real danger usually comes from clicking links, opening attachments, or entering credentials.

What is the difference between phishing and spam? Spam is unwanted bulk email. Phishing is deliberately deceptive and aims to steal information or money.

Conclusion

Phishing works because it exploits trust and urgency. Slow down, check the sender and the link, and verify through another channel when in doubt. Share this guide with someone who might need it.