Phishing Attacks: How to Spot Them Before It’s Too Late

The email arrives at 9:17 AM on a Wednesday. It appears to come from your bank. The logo is correct. The formatting matches every other email they have sent you. The message says there has been suspicious activity on your account and you need to verify your information immediately or your account will be suspended. There is a button: “Verify My Account Now.”

You click it.

In that single action, you have handed an attacker your banking credentials, potentially your personal information, and depending on what security measures your bank has in place, possibly access to every account you own. You will not know it happened until you check your balance tomorrow — or next week, or never, because some attackers wait months before using what they have taken.

This scenario plays out millions of times every day across every country, every industry, and every demographic. Phishing is the most successful cyberattack method in existence — not because it is technically sophisticated, but because it is psychologically sophisticated. It does not try to break through your security systems. It convinces you to open the door yourself.

This guide teaches you how to recognize phishing before you click, across every channel attackers use, with specific, actionable signals that you can identify in seconds — regardless of how convincing the attack appears at first glance.

What Phishing Actually Is — And Why It Keeps Working

Phishing is a social engineering attack that impersonates a trusted entity — a bank, an employer, a government agency, a technology platform, a colleague — to deceive the target into taking an action that benefits the attacker. That action is almost always one of three things: clicking a link that leads to a credential-harvesting fake website, downloading a malicious file, or transferring money or sensitive information directly.

The term comes from “fishing” — the attacker casts a lure and waits for victims to bite. The spelling with “ph” is a nod to the “phreaking” community of early telephone hackers, who used similar psychological manipulation techniques against telephone operators decades before email existed.

Phishing keeps working — year after year, despite widespread awareness, despite sophisticated email filtering, despite security awareness training programs — for reasons that are rooted in how human cognition actually operates under real-world conditions:

The cognitive shortcuts attackers exploit

Authority bias: Humans are predisposed to comply with requests from perceived authority figures — employers, government agencies, banks, law enforcement. A phishing email that establishes authority — “This is a notice from the Internal Revenue Service” or “Your IT department requires immediate action” — triggers compliance instincts that override normal skepticism.

Urgency and scarcity: When we believe we have limited time to act or that something valuable will be lost if we do not act immediately, our capacity for careful evaluation diminishes. “Your account will be closed in 24 hours” is not informing you — it is deliberately disabling your critical thinking by inducing time pressure.

Social proof and familiarity: We extend greater trust to things that look like things we already trust. A phishing email that precisely replicates the visual identity of a service you use daily benefits from the trust association you have built with the legitimate version. Your brain pattern-matches the logo, the color scheme, and the formatting — and classifies the message as coming from a trusted source before you have read a single word.

Fear of consequences: Threats of negative outcomes — account suspension, legal action, security breach, missed delivery — activate an avoidance response that prioritizes acting over verifying. An email that threatens consequences unless you act immediately exploits your instinct to avoid harm rather than your instinct to evaluate evidence.

Context exploitation: Modern phishing attacks reference real context from the target’s life — a package you are expecting, a recent transaction you made, a document a colleague actually sent. This context-awareness makes the attack feel too specific to be fake, when in reality the attacker obtained that context from social media, from a previous breach, or from simple research.

These cognitive mechanisms are not weaknesses that careless or unintelligent people have. They are standard features of human cognition that function correctly in normal social interactions and are deliberately subverted by phishing attacks. Understanding them is the first step toward recognizing when they are being exploited.

The Modern Phishing Landscape: What You Are Actually Facing

The popular image of a phishing email — badly spelled, obviously suspicious, promising Nigerian inheritance money — has not been accurate for years. Modern phishing operations range from mass automated campaigns targeting millions of recipients to precision attacks tailored so specifically to an individual that they pass every instinctive check the target applies.

Mass phishing campaigns

Automated campaigns that send millions of identical or lightly varied emails, impersonating high-volume services used by most people: Netflix, Amazon, PayPal, Microsoft, Apple, major banks, postal services. The lures are generic but effective because of scale — even a low conversion rate across millions of recipients produces substantial credential harvests. These campaigns use compromised email infrastructure, bulk sending services, and constantly rotating domains to evade filtering.

Spear phishing

Targeted attacks directed at specific individuals, researched in advance. The attacker knows your name, your role, your employer, your manager’s name, your current projects, and your recent activity on professional and social networks. The email references real context. It uses the correct internal terminology. It impersonates someone you actually know and communicate with. The conversion rate on spear phishing is dramatically higher than mass campaigns — and the potential payoff per target is correspondingly higher.

Whaling

Spear phishing directed specifically at senior executives — CEOs, CFOs, board members, and other high-privilege targets. The attacker’s goal is either to compromise the executive’s account directly or to use the executive’s identity to authorize fraudulent actions by other employees (Business Email Compromise). Whaling attacks are the most researched and the most carefully crafted phishing attempts in existence.

Smishing (SMS phishing)

Phishing delivered via text message. The same psychological tactics applied to SMS — urgency, authority, consequences, familiarity — but through a channel where users are less accustomed to skepticism than with email, where there is no visible sender address to examine, and where the abbreviated nature of mobile communication creates less context for evaluation. Package delivery notifications, bank fraud alerts, two-factor authentication interceptions, and prize notifications are the most common smishing lures.

Vishing (voice phishing)

Phone calls from attackers impersonating banks, the IRS, Microsoft support, insurance companies, or other authoritative entities. Voice interaction engages social instincts more powerfully than written communication — it is harder to refuse a direct request from a person on the phone than to ignore an email. Vishing attacks exploit the interactive nature of phone calls to guide targets through actions step by step, maintaining pressure and authority throughout the conversation.

QR code phishing (Quishing)

An emerging and rapidly growing attack vector that uses QR codes — in emails, physical mail, printed materials, or fake signage — to direct targets to malicious websites. QR codes bypass email link scanners entirely because the malicious URL is embedded in an image rather than a text hyperlink. The prevalence of legitimate QR code use in restaurant menus, payment systems, and marketing materials has normalized scanning codes without previewing their destination.

How to Spot a Phishing Email: 12 Warning Signs

No single indicator definitively identifies a phishing email — attackers work hard to eliminate obvious signals. What makes phishing identification reliable is pattern recognition: the more of the following signals are present, the higher the probability that the email is malicious. Treat each signal not as a definitive verdict but as a red flag that raises suspicion and warrants verification before any action.

Warning Sign 1: The sender address does not match the claimed identity

Email display names and actual sender addresses are entirely independent. An email can display “Amazon Customer Service” as the sender name while the actual sending address is support@amaz0n-verify.net or noreply@amazon.security-alerts.com. The display name is set by the sender — meaning an attacker can make any name appear in your email client while the actual sending address reveals the deception.

How to check: click or hover on the display name in your email client to reveal the actual sending address. Check that the domain — the part after the @ symbol — exactly matches the legitimate organization’s domain. Look for:

Completely different domains (amazon-helpdesk.com instead of amazon.com)
Subdomains that place the legitimate name before a malicious domain (amazon.security-verify.com — the domain is security-verify.com, not amazon.com)
Character substitutions (arnazon.com with an “rn” that looks like “m,” paypa1.com with the number 1 instead of the letter l)
Additional words or hyphens (paypal-support.com, microsoft-security.net)
Different top-level domains (apple.com.co, bankofamerica.org instead of .com)

Warning Sign 2: Urgent language designed to prevent careful evaluation

Legitimate organizations rarely require immediate action under threat of severe consequences. When an email insists that you must act “within 24 hours,” “immediately,” or “before your account is permanently closed,” this urgency is almost always manufactured to bypass your normal evaluation process. The goal is to make you act before you think.

Legitimate service providers, banks, and employers provide reasonable time frames for response. They also provide multiple contact channels — a phone number, a physical address, a support ticket system — rather than a single urgent link. When urgency is the primary message of an email, treat that urgency as a warning signal rather than a reason to rush.

Warning Sign 3: The link destination does not match its display text

A hyperlink in an email has two components: the text displayed to the reader and the actual URL it points to. These can be completely different. A link that reads “Click here to verify your PayPal account” might point to http://paypal-verify.phishingdomain.com. The display text and the destination have no required relationship.

How to check without clicking: hover your mouse cursor over any link in an email (without clicking) and observe the URL that appears in the status bar at the bottom of your browser or email client. On mobile, press and hold the link to see a preview of the destination URL. Verify that the domain in the actual URL matches the legitimate organization’s domain exactly, using the same checks described in Warning Sign 1.

Warning Sign 4: Requests for credentials, personal information, or payment

Legitimate organizations almost never request passwords, full credit card numbers, social security numbers, PINs, or similar sensitive information by email. Banks do not ask you to confirm your account password via a link. Your IT department does not need you to email your credentials to verify your identity. The IRS does not request payment by gift card.

Any email that requests sensitive credentials or financial information, or that directs you to a website to enter such information, should be treated with maximum skepticism regardless of how legitimate it appears. If you believe the request may be legitimate, contact the organization directly using a phone number or website address you obtain independently — not from the suspicious email.

Warning Sign 5: Unexpected or unsolicited communications

The most basic phishing check: did you initiate this interaction? Password reset emails you did not request, order confirmations for purchases you did not make, package delivery notifications for shipments you are not expecting, account verification requests for accounts you did not create, and prize notifications for contests you did not enter are all high-probability phishing indicators.

Unsolicited communications that require action are almost always either phishing or spam. The occasional exception — a legitimate security notification or an update from a service you signed up for years ago — can be verified through independent contact with the organization before any action is taken.

Warning Sign 6: Generic greetings despite appearing to know you

Legitimate services that hold your account information address you by name. “Dear Customer,” “Dear Account Holder,” “Dear User,” and “Hello there” are generic greetings used in mass phishing campaigns because the attacker does not know the names of every recipient. When an email claims to be from your bank or a service you use regularly but does not address you by your actual name, the generic greeting is a signal that the email was not generated from a system that knows your account.

Note: spear phishing attacks do use your correct name, which is why name-based verification has limits. But the absence of your name in a supposedly personalized communication remains a useful indicator.

Warning Sign 7: Mismatched visual identity and formatting inconsistencies

Phishing emails attempt to replicate the visual identity of legitimate organizations but are often imperfect. Warning signs include: logos that are slightly blurry or at incorrect proportions (indicating they were downloaded rather than sourced from official brand assets), colors that do not precisely match the organization’s brand standards, fonts that differ subtly from the legitimate organization’s typography, and formatting that is slightly off from the legitimate organization’s email templates.

Comparison is the most effective technique: if you receive a suspicious email purportedly from a service you use regularly, compare it side by side with a legitimate email from the same sender in your inbox. Inconsistencies that are invisible in isolation become obvious in comparison.

Warning Sign 8: Attachments you did not expect or request

Unexpected email attachments are one of the most reliably dangerous indicators of a malicious email — regardless of the file type. Executable files (.exe, .msi) are obvious, but macro-enabled Office documents (.doc, .xls, .ppt), PDFs with embedded scripts, compressed archives (.zip, .rar), and even image files have all been used to deliver malware.

The lure attached to these files varies: a fake invoice, a supposed contract, a shipping document, a voicemail transcript, a tax form, a job offer. The instruction is to open the attachment to view the document. Opening it executes the malicious payload.

Any unexpected attachment from any sender — including known contacts, whose accounts may have been compromised — should be verified through an independent channel before opening. If a colleague sent you a document, call or message them directly to confirm they actually sent it before you open it.

Warning Sign 9: Requests that bypass normal processes

A distinctive signal in business-targeted phishing — particularly Business Email Compromise — is the explicit instruction to bypass normal verification procedures. “Don’t go through the usual channels for this one,” “I need this done before I’m available to discuss it,” and “Keep this confidential until it’s processed” are all specific attempts to prevent the verification step that would catch the fraud.

Legitimate urgent business requests do not require bypassing verification procedures. The request to bypass is itself the red flag. Any communication — regardless of apparent sender, regardless of claimed urgency — that instructs you not to verify through normal channels is a phishing indicator of the highest priority.

Warning Sign 10: The email was sent at an unusual time

Many phishing campaigns are sent by automated systems or attackers operating in different time zones, and arrive outside normal business hours — very early morning, late at night, or on weekends. A security alert from your employer’s IT department at 3:17 AM, a payment request from your CFO on Sunday evening, or an urgent vendor communication on a public holiday all carry elevated suspicion simply by virtue of their timing.

This is not a definitive indicator — legitimate automated systems do send emails at unusual hours — but combined with other signals, timing inconsistency increases the probability of a phishing attempt.

Warning Sign 11: The communication channel is unexpected

Pay attention to which channel a communication arrives through relative to how that contact typically communicates with you. If your bank always communicates via its official app notification but suddenly sends a critical security alert by SMS to a different phone number, the channel mismatch is a signal. If your CEO always uses Slack for urgent communications but contacts you through a personal Gmail account about a wire transfer, the channel mismatch warrants verification before action.

Attackers use unexpected channels specifically because they are trying to reach targets through paths they may be less critical about — SMS instead of email, WhatsApp instead of corporate messaging, personal email instead of corporate email.

Warning Sign 12: Something just feels wrong

Security researchers who study phishing recognition have documented a consistent phenomenon: experienced phishing victims frequently report that something about the email felt slightly off before they clicked — a vague sense of wrongness that they overrode because they could not articulate specifically what was wrong. Intuitive pattern recognition is a real and valuable cognitive capability. If an email produces a sense of unease that you cannot immediately explain, treat that unease as a signal rather than an irrational response.

The correct response to “something feels wrong but I’m not sure why” is never to proceed and see what happens. It is to pause, examine the email for the specific warning signs listed in this guide, and verify through an independent channel before taking any action.

How to Spot Phishing Across Every Channel

The principles of phishing recognition remain consistent across delivery channels, but the specific signals vary. Here is how to apply them to the most common attack channels beyond email.

Spotting SMS phishing (smishing)

Signal	What it looks like
Unknown or spoofed number	Message from a number you do not recognize claiming to be from a bank or service you use; or from a number that looks like a shortcode but is actually a full phone number
Shortened URLs	bit.ly, tinyurl, or other URL shorteners hide the actual destination; legitimate services generally use their own branded domains in SMS communications
Unexpected delivery notification	Package delivery alerts for shipments you are not expecting; “your delivery failed, click to reschedule” from a carrier you did not use
Bank fraud alerts requesting action	Legitimate bank fraud alerts typically ask you to reply Y/N or call a number — they do not send links to verify your credentials
Prize or reward notifications	You have won something from a contest you did not enter; a loyalty reward requires immediate claim through a link
Government agency messages	The IRS, Social Security Administration, and most government agencies do not initiate contact by SMS for sensitive matters

Spotting vishing (phone phishing)

Caller ID spoofing: Attackers can display any number on your caller ID, including legitimate bank numbers and government agency numbers. Caller ID is not identity verification. If a caller claims to be from your bank and asks for account information, hang up and call the number on the back of your card.
Immediate urgency: Vishing attackers establish urgency immediately — your account has been compromised, you owe back taxes, your social security number has been used fraudulently. The urgency is designed to prevent you from ending the call to verify independently.
Requests for OTP codes: A caller who asks you to read back a one-time password you just received is conducting a real-time account takeover. Legitimate organizations never ask you to share OTP codes with anyone — the code is your second factor and sharing it defeats its entire purpose.
Gift card payment requests: No legitimate government agency, court system, utility company, or financial institution accepts payment by gift card. A caller who instructs you to purchase gift cards and provide the numbers is definitively conducting fraud.
Staying on the line: Attackers often instruct targets not to hang up or to call a specific callback number “through them” to prevent independent verification. A legitimate caller who asks you not to hang up to call your bank is the fraud they are claiming to protect you from.

Spotting QR code phishing (quishing)

Use a QR scanner app that previews the destination URL before opening it — many security-focused QR apps provide this function
Be particularly cautious with QR codes in unexpected physical locations — codes placed over legitimate business QR codes (on restaurant tables, parking meters, or public notices) are a documented attack vector
Verify that the URL revealed by the QR code matches the expected organization’s domain before proceeding
Be skeptical of QR codes in unsolicited emails asking you to verify something — the QR code in an email is the link equivalent of a hyperlink, and carries the same verification requirements

The Real-Time Decision Framework: What to Do When Something Looks Suspicious

Recognition is only valuable if it translates into the correct response. The following decision framework gives you a clear, consistent process for handling any communication that triggers suspicion — regardless of channel, regardless of apparent urgency.

Step 1: Stop — do not click, open, or respond

The moment suspicion is triggered, the single most important action is inaction. Do not click any link. Do not open any attachment. Do not call any number provided in the message. Do not reply to the email. The act of stopping — physically setting down the phone, closing the laptop, stepping back from the keyboard — creates the cognitive space needed to evaluate rather than react.

Step 2: Examine, do not assume

Apply the warning signs in this guide systematically. Check the actual sender address. Hover over links to see the real destination. Identify the specific triggers being used — urgency, authority, fear, unexpected content. The examination itself often resolves the question: a spoofed sender address, a mismatched link destination, or a generic greeting where your name should appear are usually conclusive.

Step 3: Verify independently before taking any action

If examination does not resolve the question, verify through an independent channel. Find the organization’s contact information through a method entirely separate from the suspicious message — type the website address directly into your browser, call the number on the back of your card, use the app you already have installed, or look up the organization’s official contact details through a search engine. Then contact the organization directly and ask whether they sent the communication.

The independent channel must be genuinely independent. Using the phone number, email address, or website link provided in the suspicious message to verify the suspicious message is not verification — it is following the attacker’s instructions.

Step 4: Report — regardless of whether you acted

Report suspicious communications to the appropriate parties:

At work: Forward the phishing email to your IT or security team using whatever reporting mechanism your organization has established (a dedicated email address, a report phishing button in your email client, or a security incident form)
For consumer phishing: Forward phishing emails to reportphishing@apwg.org (the Anti-Phishing Working Group) and to spam@uce.gov (the FTC)
For phishing impersonating specific organizations: Most major companies (Microsoft, Amazon, PayPal, banks) have dedicated abuse email addresses to report impersonation; these can be found on their official security pages
For SMS phishing: Forward the smishing text to 7726 (SPAM) — this is a universal reporting number in the US and UK used by carriers to identify and block smishing campaigns

Reporting matters beyond your own protection. Security teams use reported phishing data to identify active campaigns, block malicious infrastructure, and protect other potential victims who may not have caught the same attack. Reporting a phishing attempt you did not fall for may prevent someone else from falling for the same attack.

If you already clicked: act immediately

If you realize after the fact that you clicked a phishing link or provided information on a suspicious site, speed of response significantly limits the damage:

Change the compromised password immediately — on the affected account and any other account where you used the same password
Enable MFA on the affected account if it is not already active — this prevents the attacker from using the stolen credentials even if they already have them
Contact the legitimate organization directly — your bank, your email provider, or whichever service was impersonated — and inform them that your credentials may be compromised. They can help monitor for unauthorized activity and lock the account if necessary
At work: report to IT immediately — do not wait to see if anything happens. Early reporting enables the security team to investigate, contain any malware that may have been delivered, and revoke compromised credentials before damage accumulates
Monitor your accounts for unauthorized activity — unfamiliar logins, transactions you did not make, changes to account settings, or new accounts opened in your name
Run a security scan on the device used to click the link — if malware was delivered, endpoint security software may detect and remove it before it causes further damage

Phishing Defense at the Organizational Level

Individual recognition skills are the last line of defense. They matter enormously — but they are most effective when supported by organizational controls that reduce the volume and sophistication of phishing that actually reaches employees, and that provide a clear, blame-free process for reporting when something gets through.

Technical controls that reduce phishing exposure

Email authentication (SPF, DKIM, DMARC): These three protocols work together to verify that emails claiming to come from your organization’s domain actually originate from authorized servers, and to specify how receiving email systems should handle messages that fail verification. Implementing all three on your domain prevents attackers from spoofing your exact domain in phishing attacks against your customers, partners, and employees. DMARC reporting also provides visibility into who is sending email using your domain.
Email filtering and anti-phishing tools: Enterprise email security platforms (Microsoft Defender for Office 365, Proofpoint, Mimecast, Abnormal Security) apply machine learning and threat intelligence to identify and quarantine phishing emails before they reach inboxes. These tools are not perfect — sophisticated spear phishing passes all filters regularly — but they dramatically reduce the volume of phishing that reaches employees.
Multi-factor authentication: MFA is the control that contains the damage when phishing succeeds. If an attacker obtains a password through a phishing attack but the account is protected by MFA, the stolen credential alone cannot provide account access. MFA does not prevent phishing — but it prevents the most common consequence of phishing (account takeover) from succeeding even when the phishing itself does.
Browser isolation and link scanning: Tools that scan links in real time before the browser loads the destination — checking the URL against threat intelligence databases and analyzing the page for phishing indicators — provide an additional check on links that pass email filtering.

Building a phishing-aware culture

Regular phishing simulations: Sending simulated phishing emails to employees — using realistic, current attack templates — and providing immediate, constructive feedback to those who click is the most effective method for building phishing recognition skills at scale. Research consistently shows that employees who experience phishing simulations regularly click on actual phishing emails at significantly lower rates than those who only receive annual training.
Blame-free reporting culture: Employees who fear professional consequences for clicking a phishing link will not report it — and unreported phishing incidents become uncontained breaches. Organizations where reporting is actively encouraged, where employees who report promptly are thanked rather than disciplined, detect phishing incidents earlier and suffer less damage than those where fear suppresses reporting.
Current, relevant training: Annual security awareness training covering generic phishing concepts provides a baseline. What changes behavior is training that addresses the specific attack types currently active in your industry, uses realistic current examples rather than obviously suspicious historical ones, and is delivered in formats that engage rather than bore.
Verified payment processes: For business phishing, the most damaging attacks target financial transfers. A mandatory verbal verification requirement for any payment instruction received by email — regardless of apparent sender — eliminates BEC fraud as an effective attack against your organization. This process-level control is more reliable than any technical defense against the most sophisticated email impersonation attacks.

The Bottom Line: Skepticism Is a Security Tool

Phishing recognition is a learnable skill — but it is one that must be maintained actively rather than acquired once and considered complete. Attackers continuously adapt their techniques to current events, current platform designs, and current user behaviors. The phishing email that sophisticated users would immediately recognize as suspicious today will be replaced by a more convincing version tomorrow.

The most reliable defense is not the ability to recognize every specific phishing technique — attackers will always be developing new ones. It is the habit of applying systematic skepticism to all unsolicited communications, regardless of how legitimate they appear, and the discipline to verify independently before acting, regardless of how urgent the request seems.

That combination — skepticism and verification — is genuinely powerful. It does not require technical expertise. It does not require specialized tools. It requires only the deliberate decision to pause before clicking, examine before trusting, and verify before acting.

The attacker’s entire strategy depends on your not doing exactly that. Do it, and the attack fails — regardless of how sophisticated it is.