How to Spot a Phishing Email: Plain-English Guide

A phishing email is a fake message that pretends to come from someone you trust so that you click a link, open a file, pay money or hand over a password. It is the most common way criminals reach ordinary people online, and the messages are getting harder to tell apart from the real thing. This guide explains, in plain English, the signs to look for, a simple routine for checking a message, and exactly what to do if you have already clicked. It is written for individuals, families, older people and very small businesses. You do not need any technical knowledge to use it.

Key takeaways

Pressure is the biggest clue. A message that rushes you, scares you or promises something too good to be true deserves a second look, however real it appears.
Never use the contact details in the message. If you are unsure, go to the company yourself, using its app, a bookmark or the number on your card or bill.
Real companies do not ask for passwords by email. Banks, delivery firms and tax offices will not email you a link to "confirm" your login or payment details.
Reporting is free and helps everyone. In the UK forward suspicious emails to the National Cyber Security Centre; in the US forward them to the Anti-Phishing Working Group and report to the FTC.
Clicking is not the end of the world. If you act quickly, by changing your password, calling your bank and scanning your device, you can usually limit the damage.

What phishing is and why it works

"Phishing" is a play on the word fishing: criminals cast out lots of messages and wait for someone to bite. The UK National Cyber Security Centre (NCSC) describes it as criminals using scam emails, text messages or phone calls to trick victims, often into visiting a website that can download a virus or steal bank details or personal information. The same tricks arrive by text message (sometimes called "smishing"), by phone ("vishing") and through social media.

Phishing works because it plays on normal human feelings rather than on technical weaknesses. A message might say your parcel is stuck, your account is about to be closed, you are owed a tax refund, or someone has logged into your bank. Each one is designed to make you act before you think. The criminals also use information about you that is freely available online, such as your name, your employer or a recent purchase, to make a message feel personal. The NCSC suggests reviewing your social media privacy settings for this reason.

The scale is large. By September 2026 the public had reported more than 59.6 million scams to the NCSC's reporting service, which led to 263.7 thousand scams being taken down across 466,300 web addresses. In the US, the FBI's Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024.

Signs of a phishing email

No single sign proves a message is fake, and a good scam may show only one or two. Treat each one as a reason to slow down and check.

Warning sign	What it looks like	What to do instead
Urgency or threats	"Your account will be closed in 24 hours", "Final notice", "Unusual sign-in detected"	Pause. Open the company's app or website yourself and check there.
Something you did not expect	An invoice you do not recognise, a parcel you did not order, a prize you did not enter	If you have no account with the sender, delete and report it.
A request to "confirm" details	A link to update payment details, verify your identity or reset a password you did not ask to reset	Never enter details through an email link. The US Federal Trade Commission notes that legitimate companies will not email or text you a link to update payment information.
A generic greeting	"Dear customer", "Dear user", or just your email address	Real companies you deal with usually know your name, though this alone is not proof.
A sender address that does not match	The name says "Royal Mail" but the address is a random Gmail account or a misspelled domain	Tap or click the sender's name to see the full address. Look for small spelling changes.
A link that goes somewhere odd	The link text says one thing but points to a different website	On a computer, rest the mouse over the link without clicking to see the real address. On a phone, press and hold carefully, or simply do not use it.
Unexpected attachments	A "document", "voicemail" or "invoice" file you were not expecting	Do not open it. Ask the sender by another route whether they sent it.
Unusual ways to pay	Requests for gift cards, money transfer services or cryptocurrency	Citizens Advice lists unusual payment methods such as vouchers or transfer services as a common sign of a scam.

Signs that are no longer reliable

Spelling mistakes: older advice said scams were full of errors. Many are now well written, sometimes with help from AI tools, so good grammar is not a sign of safety.
A company logo: logos are easy to copy. A message can look identical to a real one.
A padlock in the browser: a padlock only means the connection is encrypted. Scam websites can have one too.
Your name in the message: criminals often have your name and email from old data breaches.

Check a message in two minutes

When an email makes you feel worried, excited or rushed, run through these steps before you do anything else.

Stop: do not click, reply or open attachments yet. Nothing genuine will be lost by waiting a few minutes.
Ask "was I expecting this?": the FTC suggests asking whether you have an account with the company or know the sender. If not, it is very likely phishing.
Look at who really sent it: check the full email address, not just the display name.
Check the link without clicking: on a computer, hover over it and read the address shown. If it is not the company's normal website, do not use it.
Go direct: open the company's app, type its web address yourself, or use a bookmark. If you need to phone, use the number on your card, bill or the back of your bank card, never the number in the message.
Ask someone: if you are still unsure, ask a family member, friend or colleague you trust. Scammers rely on you deciding alone.
Report and delete: if it is a scam, report it (see below) and then delete it.

A useful rule for bank calls in the UK: if someone calls claiming to be your bank, hang up and dial 159. Citizens Advice explains that 159 connects you directly to your bank, and you can check whether your bank uses it on the Stop Scams UK website.

Set up your email to catch more scams

A few one-off changes make phishing less likely to reach you, and less harmful if it does.

Turn on two-step verification: also called two-factor authentication. Even if a criminal gets your password, they also need a code or a security key. The FTC recommends it as one of four basic protections. See the Two-Factor Authentication for Everyone Guide.
Use a password manager: a password manager fills in your password only on the real website it was saved for, so it will not fill it in on a fake lookalike page. If it does not offer to fill in, treat that as a warning. See the Password Managers Explained for Everyone Guide.
Keep automatic updates on: the FTC advises setting security software and your phone to update automatically, so known holes are fixed quickly.
Back up your files: keep copies of photos and documents in the cloud or on an external drive, so a harmful attachment cannot take everything.
Use the report button in your email app: in Gmail on a computer, open the message, click More next to Reply, then Report phishing. If a real message was flagged by mistake, choose Report not phishing. Other email apps have similar options; menus change over time, so check your provider's help pages.
Take warnings seriously: Google advises that if Gmail shows a warning about a suspicious message, you should not click links, download attachments or enter personal information.

For a fuller walk-through of protecting your inbox itself, see the Securing Your Email Account Guide.

What to do if you clicked or replied

Many people feel embarrassed after clicking. Do not be: these scams are built by professionals to fool careful people. What matters is acting quickly.

What happened	Do this now
You clicked a link but typed nothing	Close the page. Run a scan with your security software and make sure your device is up to date. Watch for anything unusual.
You entered a password	Change it straight away from the real website or app. Change it anywhere else you used the same password. Turn on two-step verification.
You gave card or bank details	Call your bank using the number on your card (or 159 in the UK). Ask them to block the card and watch for unusual payments.
You opened an attachment	Update your security software, run a full scan and remove anything it finds, as the FTC advises. If the device behaves strangely, get help from a trusted shop or the manufacturer.
You sent money	Contact your bank or payment provider immediately and ask for the payment to be reversed. Then report it as a crime (see below).
You gave your National Insurance or Social Security number	In the US, go to IdentityTheft.gov for a recovery plan. In the UK, contact your bank and report to Report Fraud. See the Identity Theft Recovery Guide.

Keep the original email (do not delete it until you have reported it), and write down what you clicked, what you entered and when. Your bank and the police may ask for these details.

Where to get help

United Kingdom

Report a scam email: forward it to the NCSC's Suspicious Email Reporting Service at [email protected]. You can send as many as you like, including ones you are only slightly unsure about. You do not need to forward emails that are already in your spam folder. Suspicious websites can be reported through the NCSC's online form.
Report a scam text: forward it to 7726, a free number run by mobile networks.
If you have lost money or been hacked: report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 if you live in England, Wales or Northern Ireland. In Scotland, report to Police Scotland on 101. The NCSC is clear that its email service is not the way to report a crime.
Advice: Citizens Advice has guidance on checking whether something is a scam and what to do next.

United States

Report a phishing email: forward it to the Anti-Phishing Working Group at [email protected].
Report a scam text: forward it to SPAM (7726).
Report any phishing attempt: to the Federal Trade Commission at ReportFraud.ftc.gov.
If personal details were taken: use IdentityTheft.gov for a step-by-step recovery plan.
If you lost money online: you can also report to the FBI's Internet Crime Complaint Center (IC3).

Common failure patterns

Calling the number in the email: the "helpline" in a scam email is answered by the scammer. Always find the number yourself.
Trusting a message because it uses your name: your name and email are often already in criminals' hands from past data breaches.
Thinking "I'm too careful to fall for it": phishing is designed to catch people when they are busy, tired or worried. A routine works better than confidence.
Using the same password everywhere: one successful phishing email then unlocks your email, shopping and social media accounts as well.
Staying quiet out of embarrassment: delays make it harder for banks to stop payments. Tell your bank and report it straight away.
Only checking emails: the same tricks arrive by text, phone, social media and QR codes. Apply the same checks to all of them.

For organisations, see the Phishing Guide.

Practitioner checklist

Work through this once, then keep the "check a message" steps in mind every day.

Turn on two-step verification for your email account first, then your bank and main shopping accounts.
Set up a password manager and give each important account its own password.
Turn on automatic updates on your computer, phone and tablet.
Find the report phishing button in your email app and try it on the next scam you receive.
Save the official numbers for your bank and main services in your phone contacts, so you never need the number in a message.
Write down the reporting addresses: [email protected] and 7726 in the UK, [email protected] and ReportFraud.ftc.gov in the US.
Back up your photos and documents to the cloud or an external drive.
Agree a "check with each other" rule with family members, especially older relatives, so nobody feels they must decide alone.
If you click something, act the same day: change the password, call the bank, scan the device, report it.

How to Spot a Phishing Email Guide: Plain-English Steps to Stay Safe