How do you spot a phishing email?
Reviewed by Hritik, White Fortress Academy · last reviewed 2026-11-11
Check who really sent it, where its links really go, and whether it is rushing you. A message that pressures you to act, asks for a password or code, or comes from an address that does not match the organisation it claims to be is probably phishing.
Five checks before you click
- Sender: read the full email address, not just the display name. Lookalike domains swap or add letters.
- Links: hover over a link, or long-press on a phone, to see the real destination before you tap.
- Urgency: threats such as “your account closes today” are meant to stop you thinking.
- Requests: legitimate organisations should not ask for your password or a one-time code by email, SMS or phone.
- Attachments: do not open files you did not expect, especially zip files or Office files that ask you to “enable content”.
If you already clicked
Do not type anything into the page. If you did, change that password at once from the genuine website, turn on MFA, and tell your IT team or the real company.
Common mistakes
- Trusting the display name without checking the address.
- Clicking first and checking afterwards.
Questions people ask
Is a message from a known contact always safe?
No. Attackers can copy or take over a contact’s account, so treat unexpected links or requests the same way and confirm by another channel.
What should I do with a phishing email?
Do not reply or click. Report it with your email app’s report option or to your IT team, then delete it.
Also in the arcade: Phishing Detective, a phishing email and SMS quiz game. Terms: phishing, mfa. All quick answers · IT glossary
Plain-English guide by White Fortress Academy.