Spot a Phishing Email in 6 Warning Signs
Phishing remains the number one way scams and hacks get started: an email imitates a trusted brand to push you into clicking, signing in, or paying. The good news is that fake messages nearly always leave the same fingerprints. Here are the six signs to check before you touch a single link.
1. The sender address does not match
Never trust the display name — look at the real address. A message supposedly from your bank sent from [email protected] is nothing official. Be wary of look-alike domains (micros0ft.com, paypa1.com), misleading subdomains, and @gmail.com addresses claiming to be a major company.
2. A tone of urgency or a threat
"Your account will be suspended in 24 hours", "payment declined", "parcel on hold": fear makes you click before you think. A serious organisation never pressures you to act immediately through a link. When in doubt, take your time — that is precisely what the scammer wants to stop you from doing.
3. A link that does not go where it claims
Hover over the link with your mouse (without clicking): the real URL appears at the bottom of the screen or in a tooltip. If the text says "mybank.com" but the address points to an unknown domain, it is a trap. On mobile, press and hold to reveal the destination. When unsure, type the site's address yourself into the browser.
4. A request for sensitive information
No bank, public service, or legitimate provider will ever ask you by email for your password, your card PIN, an SMS code, or a copy of your ID. Any such request is, by definition, suspicious. Real services ask you to log in to your account — never to "confirm" your credentials in a form linked from an email.
An email that manufactures urgency and asks for your credentials already ticks two of the six boxes: do not click, verify.
5. Typos, odd layout, and dodgy attachments
Spelling mistakes, a pixelated logo, an impersonal greeting ("Dear customer"), clumsy translation — all are signals. Be especially wary of unexpected attachments — invoices in .zip files, documents asking you to "enable macros", .html files to open. An unsolicited attachment is not opened; it is checked.
6. An offer too good to be true or a surprise refund
Winning a lottery you never entered, a "pending" tax refund, a gift reserved for the first to click: if it is too good, it is fake. These lures exist to harvest your banking details or install malware.
Phishing no longer arrives only by email
The same techniques now show up by text message (called smishing) and by phone (vishing): a fake delivery notice asking for a small "customs fee", a call claiming to be your bank. The signals stay the same — urgency, an unknown link, a request for sensitive information — and so does the right response: do not click, do not call back the number provided, and reach the organisation through its official channel.
The habit that really protects you
Beyond staying alert, two habits cut the risk dramatically. First, turn on two-factor authentication on your important accounts: even if a password leaks, the scammer can do nothing without the second code. Second, use a password manager: it will never fill your credentials on a fake site, because the address does not match — a quiet but excellent phishing detector.
What to do if you are unsure
- Do not click any link and do not open any attachment.
- Contact the organisation through an official channel (address typed by hand, number on the back of your card).
- Report the message as phishing in your mail app, then delete it.
- If you already clicked and entered a password, change it immediately and turn on two-factor authentication.
The shortcut: let Yuna7 do it
Reading an email header, checking a suspicious URL, or spotting the traces of software installed after an unlucky click takes experience. You forward the suspect message to Yuna7: the AI examines the sender, unpacks the links, scans your PC for threats, applies any clean-up needed, and explains each step. You approve anything sensitive, it handles the rest.
