How to recognize phishing attempts

Phishing is when someone sends a fake message designed to look like it's from a trusted source — a bank, Google, your web host, or even your own team member. The goal is to trick you into handing over a password, clicking a malicious link, or sending money.

It is one of the most common forms of online attack, and it works even on careful people.

The warning signs of a phishing message

Train yourself to look for these patterns:

1. Urgency and panic

Phishing messages almost always create a sense of emergency:

• "Your account has been suspended — act now"
• "Unauthorized access detected — verify immediately"
• "Your payment failed — update your billing in the next 24 hours"

Real companies do occasionally send urgent messages, but legitimate companies also give you time to verify things calmly.

2. The sender's address doesn't match

The display name can say anything — "Google Security Team" — but the actual email address reveals the truth. Check the full email address, not just the name:

• Legitimate: everything after the @ is the company's own domain, such as accounts.google.com
• Phishing: security@google-alerts.net or googlesecurity@mail347.com — close to the brand name, but not the company's domain

Look carefully: phishers sometimes use subtle misspellings like g00gle.com or paypa1.com.

3. Suspicious links

Before clicking any link in an email, hover your mouse over it (on desktop) to see where it actually goes. On a phone, press and hold the link to preview the URL.

Ask: does the link destination match the company it claims to be from? A link claiming to go to your bank but pointing to bankofamerica.securelogin.xyz is fake.

4. Requests for credentials or sensitive information

Legitimate companies will almost never ask you to:

• Enter your password or 2FA code via a link in an email
• Confirm your full credit card number by email
• Download an attachment to "verify your account"

If you receive a request like this, go directly to the company's website by typing the address yourself — don't click the link.

5. Generic greetings

Phishing emails often start with "Dear Customer," "Dear User," or "Hello Account Holder" — because the attacker doesn't know your actual name.

Legitimate services you have an account with usually use your real name.

6. Poor grammar and unusual phrasing

Many phishing messages contain awkward phrasing, unusual capitalization, or grammatical errors. This used to be one of the most reliable signs, and it isn't any more: CISA notes that in the era of AI, some phishing emails now have perfect grammar and spelling, so you have to look for the other signs. Treat bad writing as a red flag, but never treat good writing as proof.

A quick decision process

When an email asks you to take action, pause and run through this:

What to do if you clicked something

Don't panic — but act quickly.

1. Don't enter any credentials on the page you landed on.
2. Close the tab immediately.
3. If you already entered your password, change it right now on the real website.
4. If you entered 2FA codes, change your password immediately — the attacker likely has access.
5. Run a malware scan if you downloaded anything. See Malware & your website explained.
6. Report it — forward the email to your email provider's abuse address, or use the "Report phishing" option.

Common questions

How do phishers make emails look so real?

Attackers copy the exact design, logo, and wording of real companies' emails. They buy domains that look similar to legitimate ones, and they use legitimate email-sending services to avoid spam filters. Some attacks are very convincing — this doesn't mean you failed if you're unsure.

What is spear phishing?

Spear phishing is targeted phishing aimed specifically at you or your company. Instead of a generic "your account" message, it uses your name, mentions your company, references a real recent event, or even pretends to be from someone you know. It is much more convincing. See Business email compromise explained.

Can phishing happen by text or phone?

Yes. Text-message phishing is often called "smishing," and phone-call phishing "vishing." The same rules apply: create skepticism when something asks you to act urgently, and never provide credentials, codes, or payment information to someone who contacted you unexpectedly.

I got a suspicious email. Should I forward it to Chykalophia?

If it relates to your website, hosting, or domain, yes — forward it to us and we can check whether it is legitimate. For emails about other services (banking, email, etc.), contact those companies directly through their official websites.

Related guides

• Common email scams targeting businesses
• Business email compromise explained
• What to do if an account is compromised
• Two-factor authentication, explained
• Safe browsing habits for your team
• I got a suspicious email — what now?

Learn more

• CISA: Malware, phishing and ransomware
• FTC: How to recognize and avoid phishing scams
• APWG: report phishing emails