How to Spot Phishing Emails: Real Warning Signs

Phishing emails used to be easy to spot: bad spelling, strange formatting, a prince who needed your help. Not anymore. Today’s phishing emails can look exactly like a message from your bank, your software provider or your own boss. CISA now warns that some phishing emails have perfect grammar and spelling, so you can’t rely on typos to catch them.

What hasn’t changed is the goal. Every phishing email wants you to do one of 3 things: click a link, open an attachment or take an action such as sending money or sharing information. Learn to slow down at those 3 moments and check a handful of clues, and you’ll catch most of the tricks attackers rely on. This guide walks through annotated example emails so you can see exactly where to look.

Why phishing still works

Phishing works because it targets people, not technology. A well-timed message about an unpaid invoice, an expiring password or an urgent request from the CEO creates pressure, and pressure makes people skip checks.

The financial damage is large. The FBI’s Internet Crime Complaint Center (IC3) received more than 1 million complaints in 2025, and business email compromise, a type of phishing where criminals impersonate executives, vendors or partners to redirect payments, accounted for about $3.05 billion in reported losses. The FBI notes that many victims never report, so actual losses are higher.

The 8 warning signs to check

Before you click, open or act, check these clues. The FTC and CISA list most of them in their phishing guidance.

The FTC notes that real companies won’t email or text you a link to update your payment information. That single rule catches a lot of scams.

Annotated example emails

The 3 examples below show how those clues appear in real-world-style messages. All names, addresses and domains are invented.

Example 1: the fake password expiry

Here’s a typical credential phishing email.

``` From: IT Help Desk helpdesk@mail-account-services.net Subject: ACTION REQUIRED: Your mailbox password expires today

Dear User,

Your email password will expire in 2 hours. To avoid losing access to your mailbox and files, please verify your account now.

[Keep My Password]

Failure to verify will result in permanent account suspension.

Thank you, IT Help Desk ```

What to notice:

1. The sender’s domain is not your company’s domain. Your IT team would email from your own domain or tell you in person.
2. “Dear User” is generic. Your IT team knows your name.
3. The deadline of 2 hours is designed to rush you.
4. The button almost certainly leads to a fake login page. Hovering would reveal a strange web address.
5. The threat of “permanent account suspension” is a pressure tactic.

The safe move: don’t click. Go to your email account the way you normally do, or ask IT directly. If you entered your password on a fake page, change it immediately and make sure multifactor authentication is on. Our guide to setting up two-factor authentication explains how.

Example 2: the vendor bank-change request

This is business email compromise. It often contains no links or attachments at all, which helps it slip past filters.

``` From: Maria Lopez maria.lopez@northwind-supplies.co Subject: Updated remittance details

Hi Sam,

Hope your week is going well. Please note we have changed banks and all future payments should go to the account below, effective immediately. Our old account is under audit, so please don’t use it.

Can you confirm once the March invoice is paid to the new account? I’m in meetings all day so email is best.

Thanks, Maria ```

What to notice:

1. The domain is close to your real vendor’s, but not identical. Maybe the real one is northwindsupplies.com. Compare it against earlier emails from Maria.
2. The request to change bank details is the biggest red flag of all, no matter how friendly the tone.
3. “Effective immediately” and “don’t use the old account” add urgency.
4. “Email is best” tries to stop you from calling.
5. It may come from the real account. If the vendor’s mailbox was hacked, the address could be genuine. That’s why domain checks alone aren’t enough here.

The safe move: always verify bank-detail changes by calling the vendor on a phone number you already have on file, never the number in the email. CISA recommends looking up contact information yourself or using a method you already know. Make this a written company rule.

Example 3: the fake shipping or invoice notice

``` From: Delivery Notification notice@parcel-track-update.info Subject: Delivery attempt failed - reschedule required

We were unable to deliver your package. A redelivery fee of $1.99 is required. Scan the code below or open the attached form to schedule a new delivery.

[QR code] Attachment: Delivery_Form.html ```

What to notice:

1. You weren’t expecting a package, or you don’t use this carrier.
2. A small fee is a common trick to collect card details.
3. A QR code moves the link to your phone, where it’s harder to inspect and may sit outside company security filters. The FTC has warned that scammers hide harmful links in QR codes.
4. An HTML attachment can open a fake login or payment page stored on your own computer.

The safe move: track packages from the carrier’s official website or app by typing the address yourself.

Key takeaway: Slow down at 3 moments: before you click a link, before you open an attachment and before you send money or information. At each one, ask “Was I expecting this?” and “Can I verify it another way?”

New tricks to watch for

Attackers adapt quickly. Watch for these newer approaches:

• AI-written emails with flawless grammar and a convincing tone. Judge the request, not the writing.
• QR code phishing in emails, PDFs and printed notices.
• Callback phishing, where the email contains no link but asks you to call a number about a fake charge or subscription. The person who answers then talks you into installing remote access software.
• Shared-document lures pretending to be a file shared through a legitimate cloud service.
• MFA fatigue, where an attacker who already has your password sends repeated sign-in approval requests hoping you’ll tap “approve.” Never approve a sign-in you didn’t start.
• Voice and video impersonation of executives using deepfake technology. See how to spot a deepfake.

How to check a suspicious email in 60 seconds

1. Pause. Don’t click, reply or open anything yet.
2. Check the full sender address. Tap or hover over the display name to reveal the actual address.
3. Hover over links on a computer to preview the destination. On a phone, press and hold the link to preview it without opening it.
4. Ask whether you expected it. Unexpected invoices, deliveries, password notices and payment requests deserve extra scrutiny.
5. Verify independently. Contact the person or company using a phone number or website you already know, not the details in the message.
6. Report it. Use your email’s “Report phishing” or “Report” option, or forward it to your IT contact.
7. Delete it. CISA’s advice is simple: once reported, just delete. Don’t click “unsubscribe.”

What to do if you clicked

Mistakes happen. What matters is how fast you act.

• If you entered a password: change it immediately from a trusted device, and change it anywhere else you reused it. Confirm MFA is on.
• If you opened an attachment or installed something: disconnect the device from the network and tell your IT contact right away. The FTC advises updating your security software and running a scan.
• If you sent money: call your bank immediately to try to stop or recall the transfer, then file a complaint with the FBI at ic3.gov.
• If you shared personal information: visit IdentityTheft.gov for recovery steps based on what was exposed.

To report phishing outside your company, the FTC recommends forwarding phishing emails to reportphishing@apwg.org, forwarding scam texts to 7726 (SPAM) and reporting at ReportFraud.ftc.gov.

Where to start: make phishing harder for your whole team

1. Turn on MFA everywhere, and consider phishing-resistant options such as passkeys, which won’t work on fake sites.
2. Set a payment verification rule: every new payee or bank-detail change is confirmed by phone using a known number.
3. Add an external sender warning in your email system so messages from outside the company are clearly labeled.
4. Make reporting easy with a report button or one forwarding address, and thank people who use it.
5. Train monthly with short lessons and practice emails. Our guide to security awareness training includes a 12-month plan.
6. Fold it into your full plan using our small business cybersecurity checklist.

Conclusion

You don’t need to be a security expert to spot phishing. Check the sender’s real address, preview links before clicking, treat urgency and payment requests with suspicion, and verify anything unexpected through a channel you already trust. Don’t rely on spelling mistakes, because many phishing emails no longer have them. And if you do click, report it fast. A quick report turns a mistake into a near miss.

Sources

• CISA: Recognize and Report Phishing — warning signs, perfect grammar caveat and reporting steps
• CISA: Teach Employees to Avoid Phishing — red flags and independent verification
• FTC: How to Recognize and Avoid Phishing Scams — common phishing stories, what to do and how to report
• FTC: Scammers hide harmful links in QR codes — QR code phishing
• FBI IC3: 2025 Internet Crime Report — complaint totals and business email compromise losses