How to Spot a Phishing Email: Red Flags, Examples, and Reporting Steps

Overview

If you want a simple answer to how to spot a phishing email, start here: treat any unexpected message that asks you to click, sign in, pay, download, share data, or bypass normal process as untrusted until it is verified.

Most phishing attempts do not rely on advanced technical tricks alone. They work because they imitate normal communication patterns: a password reset notice, an invoice, a shared document, a shipping alert, a payroll request, a calendar invitation, or a message from a manager. The sender wants you to react before you inspect the details.

A good suspicious email check is not about finding one perfect signal. It is about stacking several small checks together:

• Context: Were you expecting this message?
• Sender: Does the real address match the display name and domain you trust?
• Action: Is the requested action normal for this person or service?
• Link destination: Does the link go where the text says it goes?
• Attachment type: Is there any reason this file should be sent to you?
• Tone: Does the message push fear, secrecy, haste, or authority?
• Verification path: Can you confirm it through a separate channel?

For teams that manage webmail and business email, phishing detection is also part of a broader security posture. If you are reviewing your setup more generally, see Webmail Security Checklist for Small Businesses and IT Teams and Securing webmail login: MFA, SSO, and session management best practices.

Use the checklist below as a repeatable habit. The point is not to become suspicious of every message. The point is to slow down at the exact moments attackers try to speed you up.

Checklist by scenario

This section gives you scenario-based phishing email signs so you can scan quickly based on what is in front of you.

1) Password reset or account warning emails

These are among the most effective phishing formats because they imitate normal security workflows.

• Did you actually request a password reset or login verification?
• Does the email pressure you with language like “act now,” “account suspended,” or “security breach detected” without clear account context?
• Does the sender address use a lookalike domain, extra characters, or a misspelling?
• When you hover over the button, does the destination URL match the legitimate provider domain?
• Are you being asked to sign in through a link in the email rather than by visiting the known site directly?

Safe response: do not use the email link. Open a fresh browser tab and go to the provider’s official login page yourself. If you need help identifying official access pages, use a maintained reference such as Webmail Login Pages for Popular Email Providers: Official URLs and Access Help.

2) Invoice, payment, and purchase emails

Financial messages often exploit confusion: a fake overdue notice, a purchase you did not make, or a billing file that must be opened immediately.

• Is the charge unfamiliar, but the email makes it easy to “review details” only through a linked button?
• Is there a ZIP, HTML, executable, or macro-enabled attachment?
• Does the message avoid specific account details and rely on generic language?
• Is the sender domain slightly off from a known vendor or billing system?
• Does the message try to force you into a refund or cancellation workflow that asks for credentials?

Safe response: access the vendor account directly from your saved bookmarks or internal finance system. Do not open suspicious attachments to “see what it is.”

3) Messages that appear to come from your boss or internal team

Executive impersonation and internal spoofing are common because people are less likely to question authority.

• Is the request unusual for that person, such as asking for gift cards, payroll files, tax records, wire details, or emergency transfers?
• Does the email ask you to keep the request confidential or avoid normal approval steps?
• Is the writing style different from the sender’s normal tone?
• Is the sender using a personal email address or a lookalike internal domain?
• Is the message urgent in a way that bypasses process?

Safe response: verify through a separate channel you already trust, such as a known phone number, internal chat, or ticketing system. Never reply only within the suspicious thread to confirm authenticity.

4) Shared document, cloud storage, or collaboration invites

These scams mimic common workplace tools and often target people used to daily notifications.

• Were you expecting a file share or document comment?
• Does the email address the document vaguely instead of naming the project or file?
• Do the button and link text suggest one service while the URL leads elsewhere?
• Are you being asked to log in again unexpectedly to view a file?
• Does the page behind the link look close to a familiar service but slightly wrong?

Safe response: open your collaboration tool directly and check for the file or invite inside the service. If nothing is there, assume the email is suspicious.

5) Delivery, travel, event, and account verification notices

These scams rely on routine volume. If you receive many notifications every day, one more may not feel unusual.

• Did you order something, book travel, or register for an event recently?
• Is the message vague about tracking number, booking reference, or account identity?
• Does it prompt an urgent update to payment, address, or customs details?
• Are there odd formatting issues, strange capitalization, or inconsistent branding?
• Is there a request to download a form or print a label from an unfamiliar link?

Safe response: check the status in the official app or service portal, not from the email.

6) Security alerts sent to IT, developers, or admins

Technical users are often targeted with more convincing lures: repository alerts, domain notices, API key warnings, mailbox quota alerts, admin review requests, or infrastructure login prompts.

• Is the email trying to trigger privileged action, such as credential rotation, mailbox reauthentication, or DNS changes?
• Does it mention SPF, DKIM, DMARC, TLS, quota, or mail server settings in a generic way without system-specific context?
• Does the domain belong to the real service, or just look similar?
• Does the linked page ask for administrative credentials outside normal SSO flow?
• Are you being pushed to install a tool or open a script to resolve the issue?

Safe response: verify by logging into the vendor console directly. For related operational topics, refer to Custom Domain Email Setup Checklist: DNS, MX, SPF, DKIM, and DMARC and Implementing DKIM, SPF and DMARC: an understandable roadmap for developers.

7) Attachments that demand immediate attention

Attachments remain a common delivery method for credential theft and malware.

• Is the attachment unexpected?
• Does the filename use double extensions, strange naming, or misleading labels?
• Are you being asked to enable editing, enable content, or run embedded code?
• Is the file type unusual for the sender’s normal workflow?
• Could the same content have been sent as plain text or through a known portal instead?

Safe response: do not open it until confirmed. In managed environments, report the message so the security or IT team can inspect it safely.

What to double-check

When a message feels off but you cannot immediately explain why, these are the details worth checking before you act.

Look past the display name

Email clients often show a friendly sender name first and hide the real address. Expand the sender details and inspect the full email address and domain. A display name that says “Microsoft Support” or “Accounts Payable” means very little by itself.

Hover before clicking

On desktop, hover over buttons and links to preview the destination. On mobile, use the client’s preview options if available or avoid interacting until you can check more safely. A legitimate-looking button can point to an unrelated domain.

Check for domain tricks

Common signs include extra words, swapped letters, added hyphens, misleading subdomains, or character lookalikes. The domain that matters is usually the registered domain in the actual URL, not just the first familiar word you notice.

Read for pressure, not just grammar

Poor grammar can be a clue, but polished language does not mean a message is safe. Focus on manipulative patterns: urgency, fear, secrecy, authority, reward, or confusion. These emotional triggers are often stronger signals than spelling mistakes.

Compare the request to normal process

A message can be technically well-made and still be suspicious because the request itself is wrong. If your organization normally uses a ticket, approval workflow, finance platform, or identity provider, any request to bypass that process deserves scrutiny.

Inspect attachments as a risk category

Even if the sender appears known, ask whether the file should exist in that context. Unexpected HTML files, archives, scripts, and office documents requesting macros should raise concern.

Use out-of-band verification

The safest verification path is separate from the suspicious message. Call the sender using a saved number, open the service directly from a bookmark, or ask the internal team in a known chat channel. Do not trust contact details supplied only inside the suspicious email.

Know what reporting looks like in your environment

For some readers, the best next step is a built-in “report phishing” button. For others, it may be forwarding the message as an attachment to security staff, opening a helpdesk ticket, or using the provider’s abuse workflow. Define the process before you need it.

If you are also troubleshooting general access problems and want to avoid mistaking legitimate service issues for phishing, these references may help: How to Fix Webmail Login Problems: A Step-by-Step Troubleshooting Guide and IMAP, POP3, and SMTP Settings for Major Email Providers.

Common mistakes

Even careful users make avoidable errors under time pressure. These are the ones that matter most.

• Trusting branding too quickly: Logos, signatures, and polished templates are easy to imitate.
• Checking only one signal: A familiar name or decent grammar is not enough to declare a message safe.
• Replying to ask if the email is real: If the thread is controlled by an attacker, you are still in the trap.
• Using the email’s own links to verify the email: Verification should happen outside the message.
• Opening attachments “just to see”: Curiosity is exactly what many lures depend on.
• Forwarding suspicious emails casually: This can spread malicious links or attachments internally. Use your reporting process instead.
• Ignoring near-miss incidents: An email you recognized in time is still useful. Reporting it may help protect other users.
• Assuming technical roles are immune: Developers, admins, and security-aware users are often targeted with more specialized pretexts.

A useful habit is to separate message legitimacy from . Even if an issue is real, you do not need to handle it through the exact path presented in the email. You can always go to the service directly, use known login pages, or confirm with the responsible team.

If your organization is evaluating providers or interfaces, user experience can affect phishing resistance too. Clearer login flows, better warning surfaces, and integrated reporting can reduce errors. See Business Email Hosting Comparison: Webmail Features, Security, and Pricing and Comparing webmail clients for enterprise use: criteria for choosing the right interface.

When to revisit

This checklist becomes more useful when you return to it before risk increases or workflows change. Revisit and update your anti-phishing habits in these moments:

• Before seasonal planning cycles: holidays, year-end finance work, tax periods, major procurement windows, and back-to-school or travel-heavy periods often change message volume and expectations.
• When workflows or tools change: new SSO, new webmail interface, new collaboration suite, new invoicing system, or new HR platform can change what legitimate notifications look like.
• After mailbox migrations or domain changes: users are more likely to trust unexpected notices when login behavior and settings are already in flux.
• When teams adopt new automation: alerts from APIs, webhooks, and workflow tools can create fresh impersonation opportunities. For that context, see Building automation for email workflows: APIs, webhooks and integration patterns for developers.
• After any phishing incident or near miss: update internal examples and remind users what the latest scam pattern looked like.

For a practical next step, create a short personal or team playbook with five items:

1. The official login URLs for key services.
2. Your approved reporting method for suspicious emails.
3. The out-of-band verification channels for finance, HR, and leadership requests.
4. The most common phishing scenarios in your environment.
5. A rule that no urgent email overrides standard approval or authentication process.

If you need one principle to keep in mind, make it this: never let an email choose the verification path for you. Use known URLs, known contacts, and known workflows. That one habit will catch a large share of phishing attempts before they become account compromise, payment fraud, or data exposure.