How to Check If an Email Is Phishing
Phishing emails are designed to trick you into revealing passwords, payment details, or personal data.
This guide explains how to check if an email is phishing using clear signals, simple verification steps, and security checks that work across Gmail, Outlook, and other email platforms.
The challenge is that many phishing messages now look polished, use familiar branding, and exploit current events.
The good news is that a few consistent checks can expose most of them before damage is done.
Start With the Sender, Not the Subject Line
Phishing often begins with an urgent or alarming subject line, but the real story is usually in the sender details.
Always inspect the full email address, not just the display name.
- Look for misspellings in the domain name, such as paypaI.com instead of paypal.com.
- Check whether the address uses a free email service for a message that claims to be from a bank, delivery company, or employer.
- Compare the sender domain to the company’s official domain on its website.
Display names are easy to fake.
A message can appear to come from “Microsoft Security” while the underlying address is unrelated.
Read the Message for Urgency and Pressure
Phishing emails often push you to act quickly so you won’t verify the request.
Common pressure tactics include threats of account closure, fake refund deadlines, or warnings that a package cannot be delivered.
- Be cautious with phrases like “act now,” “final notice,” and “account suspended.”
- Watch for demands to click a link, open an attachment, or provide credentials immediately.
- Question any message that creates panic without giving you time to confirm details.
Legitimate organizations may send time-sensitive notices, but they usually provide clear instructions and multiple ways to verify the request.
Examine the Links Before You Click
One of the most effective ways to check if an email is phishing is to inspect any embedded links.
Hover over the link on desktop or press and hold on mobile to preview the destination URL.
- Confirm the visible text matches the actual destination.
- Look for unusual domains, extra words, or shortened links.
- Avoid logging in through a link in the email when you can go directly to the company’s official website.
Attackers often use lookalike domains, subdomains, or URL paths that seem legitimate at a glance.
For example, a malicious link may include a trusted brand name in the path while pointing to an unrelated domain.
Check for Writing Errors and Unusual Formatting
Many phishing emails still contain grammar mistakes, odd phrasing, or formatting problems.
While some are highly polished, errors remain a common clue.
- Look for awkward wording, inconsistent capitalization, or generic greetings such as “Dear Customer.”
- Notice if logos appear blurry, cropped, or outdated.
- Watch for broken layouts, mismatched fonts, or strange spacing.
Professional organizations usually maintain consistent branding and polished copy.
A message that looks slightly “off” deserves closer scrutiny.
Verify Requests Through a Separate Channel
If an email asks you to reset a password, review an invoice, approve a payment, or confirm sensitive information, verify it independently.
Do not reply to the email or use the contact details inside it.
- Open the company’s official website by typing the address manually.
- Use the phone number listed on a statement, membership card, or official site.
- Sign in directly to your account dashboard to check whether the request is real.
This step is especially important for banking, payroll, shipping, cloud services, and government-related messages.
Phishing often succeeds because people trust the email content instead of confirming the request elsewhere.
Look for Requests That Break Normal Procedures
Another strong indicator of phishing is a request that does not fit how the organization normally works.
Fraudsters rely on unusual exceptions because they are harder to question in the moment.
- An employer asks for gift cards, wire transfers, or confidential data by email.
- A bank asks you to confirm a full password or one-time code.
- A vendor sends a new payment method without prior discussion.
Organizations typically have established processes for payment, identity verification, and account access.
If a message bypasses those steps, treat it as suspicious.
Inspect Attachments Carefully
Attachments can carry malware, credential-stealing documents, or fake invoices.
Be especially cautious with files you were not expecting.
- Do not open executable files, compressed archives, or unfamiliar document types.
- Be wary of Office documents that request macros or content enabling.
- Scan files with your security software before opening them.
Even PDF files can be used in phishing campaigns if they contain malicious links or convincing fake forms.
Unexpected attachments deserve the same level of skepticism as suspicious links.
Use Email Authentication Clues When Available
Some email clients show indicators that help confirm whether a message passed authentication checks such as SPF, DKIM, and DMARC.
These technical standards reduce spoofing but do not eliminate phishing.
- Check whether the email is marked as verified or authenticated by your provider.
- Remember that a verified sender can still be malicious if their account was compromised.
- Use authentication signals as one clue, not a final decision.
In enterprise environments, security teams may also use secure email gateways, threat intelligence, and domain monitoring to detect impersonation attempts.
End users should still confirm any sensitive request before acting.
What to Do If You Suspect Phishing?
If an email looks suspicious, the safest response is to avoid interacting with it.
One accidental click can expose you to fake login pages, malware, or follow-up attacks.
- Do not reply, click links, download attachments, or forward the message to coworkers without context.
- Mark it as phishing or junk in your email client.
- Report it to your organization’s IT or security team if it targets work accounts.
- If you entered credentials, change your password immediately and enable multi-factor authentication.
If a financial account may be affected, contact the institution directly using a trusted phone number.
Fast action can limit account takeover and unauthorized transactions.
How to Check If an Email Is Phishing in Gmail or Outlook?
Most major email platforms provide built-in tools that make suspicious messages easier to assess.
In Gmail and Outlook, open the message details to review the sender address, reply-to field, and any security indicators.
- In Gmail, use the message menu to view the original headers when necessary.
- In Outlook, inspect the message properties or report message options.
- Use the built-in phishing report function so the platform can improve filtering.
For business users, Microsoft Defender for Office 365, Google Workspace security tools, and third-party email security platforms can add another layer of inspection.
These tools are useful, but human verification still matters.
Common Signs of a Phishing Email at a Glance
If you need a quick checklist, look for the following red flags before taking action:
- Unexpected urgency or threats
- Sender address that does not match the brand
- Links pointing to unfamiliar domains
- Requests for passwords, codes, or payment information
- Poor grammar, odd formatting, or generic greetings
- Unexpected attachments or file types
- Instructions that bypass normal company procedures
The more of these signals you see in one message, the more likely it is to be phishing.
A single clue may be harmless; several together usually mean the email should be avoided and reported.
Why Phishing Emails Keep Working
Phishing succeeds because attackers study user behavior, public branding, and current events.
They often copy real templates, reuse logos, and time messages around tax season, package delays, password resets, or account alerts.
That is why checking only one detail is not enough.
The safest approach is to combine sender verification, link inspection, content review, and independent confirmation before you respond.