How to recognize phishing attempts

Phishing is when someone sends a fake message designed to look like it's from a trusted source — a bank, Google, your web host, or even your own team member. The goal is to trick you into handing over a password, clicking a malicious link, or sending money.

It is the most common way business accounts get compromised, and it works even on careful people.

The warning signs of a phishing message

Train yourself to look for these patterns:

1. Urgency and panic

Phishing messages almost always create a sense of emergency:

• "Your account has been suspended — act now"
• "Unauthorized access detected — verify immediately"
• "Your payment failed — update your billing in the next 24 hours"

Real companies do occasionally send urgent messages, but legitimate companies also give you time to verify things calmly.

2. The sender's address doesn't match

The display name can say anything — "Google Security Team" — but the actual email address reveals the truth. Check the full email address, not just the name:

• Legitimate: no-reply@accounts.google.com
• Phishing: security@google-alerts.net or googlesecurity@mail347.com

Look carefully: phishers sometimes use subtle misspellings like g00gle.com or paypa1.com.

3. Suspicious links

Before clicking any link in an email, hover your mouse over it (on desktop) to see where it actually goes. On a phone, press and hold the link to preview the URL.

Ask: does the link destination match the company it claims to be from? A link claiming to go to your bank but pointing to bankofamerica.securelogin.xyz is fake.

4. Requests for credentials or sensitive information

Legitimate companies will almost never ask you to:

• Enter your password or 2FA code via a link in an email
• Confirm your full credit card number by email
• Download an attachment to "verify your account"

If you receive a request like this, go directly to the company's website by typing the address yourself — don't click the link.

5. Generic greetings

Phishing emails often start with "Dear Customer," "Dear User," or "Hello Account Holder" — because the attacker doesn't know your actual name.

Legitimate services you have an account with usually use your real name.

6. Poor grammar and unusual phrasing

Many phishing messages contain awkward phrasing, unusual capitalization, or grammatical errors. This is not universal — well-crafted phishing can look very polished — but bad writing is always a red flag.

A quick decision process

When an email asks you to take action, pause and run through this:

What to do if you clicked something

Don't panic — but act quickly.

1. Don't enter any credentials on the page you landed on.
2. Close the tab immediately.
3. If you already entered your password, change it right now on the real website.
4. If you entered 2FA codes, change your password immediately — the attacker likely has access.
5. Run a malware scan if you downloaded anything. See Malware & your website explained.
6. Report it — forward the email to your email provider's abuse address, or use the "Report phishing" option.

Common questions

Related guides

• Common email scams targeting businesses
• Business email compromise explained
• What to do if an account is compromised
• Two-factor authentication, explained
• Safe browsing habits for your team

Learn more

• CISA: Phishing guidance
• FTC: How to recognize and avoid phishing scams
• Anti-Phishing Working Group