How to spot a phishing email: 12 warning signs
2 min read · Updated October 15, 2026
Phishing emails create urgency, impersonate a trusted sender and push you to click a link, open a file or share a login. Check the sender’s real address, hover over links before clicking, be suspicious of unexpected attachments and go to the official website yourself instead of using the message’s link.
The warning signs
- ✓Urgency or threats: ‘act now or your account will be closed’.
- ✓A sender address that does not match the company’s real domain.
- ✓A generic greeting such as ‘Dear customer’ from a company that knows your name.
- ✓Links whose visible text differs from the real destination.
- ✓Unexpected attachments, especially zip files or documents asking to ‘enable content’.
- ✓Requests for passwords, codes or payment details by email.
- ✓Offers that are too good to be true, refunds you did not expect or prizes you did not enter.
- ✓Spelling and formatting oddities, although polished phishing also exists.
- ✓Messages that mimic a breach alert or security warning.
- ✓A request to keep something secret or bypass normal procedures.
- ✓Mismatched context: a delivery notice when you ordered nothing.
- ✓A message from a colleague or boss with an unusual request, especially about money.
How to check safely
- ✓Look at the full sender address, not just the display name.
- ✓Hover over links (or long-press on a phone) to see where they lead.
- ✓Open the company’s website or app yourself instead of using the link.
- ✓Call the company using a number from its official site.
Got a suspicious email about a leak?
Scammers love leaked data. See whether your address is genuinely in a known breach so you know how much of the message is real.
Why leaks make phishing better
When your data appears in a breach, scammers can mention real services, real purchases or even real passwords to look convincing. That is why a breach often leads to targeted phishing. Knowing whether your address was exposed helps you judge how seriously to treat messages that seem unusually specific.
What to do with a suspicious email
Do not click, reply or open attachments. Report it using your provider’s phishing option, then delete it. If you already interacted, follow the steps for what to do after clicking a phishing link.
Frequently asked questions
Can I get hacked just by opening a phishing email?+
Rarely. The danger usually comes from clicking links, entering details or opening attachments.
Why do I get so many phishing emails?+
Your address may be in lists from breaches or data brokers. Checking for exposure can explain the volume.
Are phishing texts the same?+
Same idea, different channel. Treat unexpected texts with links the same way.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.