How to recognize phishing attempts

Q: I reported an email as phishing but it's still in my inbox. Did the report work?

It depends on the platform. Microsoft says Report → Report phishing in Outlook both reports the message and removes it from your inbox. Gmail's own steps for reporting phishing don't say the message leaves your inbox, so if it's still sitting there afterwards, just delete it.

Phishing is when someone sends a fake message designed to look like it's from a trusted source: a bank, Google, your web host, or even your own team member. The goal is to trick you into handing over a password, clicking a malicious link, or sending money. Usually that means one of:

Getting you to enter your password on a fake website
Getting you to approve a fraudulent payment
Getting you to download malicious software

The word comes from "fishing": attackers cast a wide net hoping some people take the bait.

It is one of the most common forms of online attack, and it works even on careful people.

The warning signs of a phishing message

Train yourself to look for these patterns:

1. Urgency and panic

Phishing messages almost always create a sense of emergency:

"Your account has been suspended: act now"
"Unauthorized access detected: verify immediately"
"Your payment failed: update your billing in the next 24 hours"

Real companies do occasionally send urgent messages, but legitimate companies also give you time to verify things calmly.

2. The sender's address doesn't match

The display name can say anything, "Google Security Team", but the actual email address reveals the truth. Check the full email address, not just the name:

Legitimate: everything after the @ is the company's own domain, such as accounts.google.com
Phishing: security@google-alerts.net or googlesecurity@mail347.com, close to the brand name, but not the company's domain

Microsoft calls this a mismatched email domain: a message that claims to be from a reputable company but arrives from somewhere else, like a gmail.com address or microsoftsupport.ru.

Watch for lookalike domains with extra words or hyphens, such as @google-security.net or @paypal-security.com
Watch for very subtle misspellings like g00gle.com or paypa1.com. Microsoft's own examples are micros0ft.com, where the second "o" is a zero, and rnicrosoft.com, where the "m" is an "r" and an "n"
A familiar-looking address isn't proof on its own. If a security email appears to be from Google, Google's advice is to type myaccount.google.com/notifications into your browser and check your account's recent activity there, rather than clicking anything in the email

The same goes for people you know. An email that says it's from "Jane Smith, your accountant" might come from an attacker's address, so check the actual address whenever something feels off.

3. Suspicious links

Before clicking any link in an email, hover your mouse over it (on desktop) to see where it actually goes: the URL appears in the status bar, usually at the bottom of your browser. On a phone, press and hold the link to preview the URL.

Ask: does the link destination match the company it claims to be from? A link claiming to go to your bank but pointing to bankofamerica.securelogin.xyz is fake.

Legitimate: https://accounts.google.com/signin
Suspicious: https://accounts-google-signin-verify.com/user

Even one wrong character can mean a fake site. When in doubt, open a new browser tab and type the address yourself.

4. Requests for credentials, or requests you didn't expect

Legitimate companies will almost never ask you to:

Enter your password or 2FA code via a link in an email
Confirm your full credit card number by email
Download an attachment to "verify your account"

Be just as suspicious of any request you weren't expecting, such as approving a payment or verifying an account, when you didn't initiate anything.

If you receive a request like this, go directly to the company's website by typing the address yourself. Don't click the link.

5. Generic greetings

Phishing emails often start with "Dear Customer," "Dear User," or "Hello Account Holder", because the attacker doesn't know your actual name.

Legitimate services you have an account with usually use your real name.

6. Poor grammar and unusual phrasing

Many phishing messages contain awkward phrasing, unusual capitalization, or grammatical errors. This used to be one of the most reliable signs, and it isn't any more: CISA notes that in the era of AI, some phishing emails now have perfect grammar and spelling, so you have to look for the other signs. Microsoft points out that real companies usually have editorial staff, so obvious mistakes are still a warning sign. Treat bad writing as a red flag, but never treat good writing as proof.

7. Attachments you didn't expect

An unexpected invoice, shipping notice, or document attachment should be treated with suspicion. Attachments can contain malware (software that infects your computer when opened).

Try it

Spot the seven warning signs

A made-up example. Tap a numbered marker to see each warning sign.

FromExample Account Security <security@examp1e-alerts.example>

SubjectURGENT: Your account will be suspended in 24 hours

Dear Customer,

We have detected unusual sign-in activity on you account. For you're protection, Verify your details immediately.

Please confirm your password and the 2FA code we send you using the secure link below.

Verify my account

Attachment: Account_Review_Form.zip

Thank you,
The Example Security Team

Seen 0 of 7

List all the red flags as text

Urgency and panic. In this email: the subject says your account will be suspended in 24 hours.
The sender's address doesn't match. In this email: the name says "Example Account Security", but the address is security@examp1e-alerts.example. Look closely: "examp1e" has the number 1 where the letter l should be, and it isn't the company's own domain, example.com.
Suspicious links. In this email: the button says "Verify my account", but hovering shows it goes to example-com.account-verify.example, not example.com.
Requests for credentials, or requests you didn't expect. In this email: it asks you to confirm your password and 2FA code through a link.
Generic greetings. In this email: "Dear Customer", not your name.
Poor grammar and unusual phrasing. In this email: "on you account", "For you're protection" and the stray capital in "Verify".
Attachments you didn't expect. In this email: an attachment you didn't expect, Account_Review_Form.zip.

Common phishing scenarios for businesses

Scenario	What to watch for
"Verify your Google account"	Links to a fake Google login page
"Microsoft security alert"	Links to a fake Microsoft login page
"Invoice from [supplier]"	Attachment contains malware
"Payment request" from a colleague	Attacker has access to a real inbox or is using a lookalike address
"Pending delivery" from a courier	Link to a fake fee payment page

For more of the scams aimed at small businesses, see Common email scams targeting businesses.

A quick decision process

When an email asks you to take action, pause and run through this:

Check the sender's actual email address. Does it match the company's real domain? Hover over or tap the sender's name to see the full address.

Hover over any links. Does the URL destination look like the company's real website?

Did you expect this message? An invoice from a supplier you've never heard of, a password reset you didn't request, a shipping notification for something you didn't order. These are red flags.

Is it creating pressure to act fast? Slow down. Urgency is a manipulation tactic.

When in doubt, go directly to the website. Type the company's URL into your browser. Don't click the link in the email. Log in and check whether there is actually a problem.

Troubleshooter

Is this email phishing?

Does the sender's actual email address match the company's real domain?

What to do if you receive a phishing email

Don't click any links or open attachments. Close the email.

If you're unsure, verify through a different channel. Call the person or visit the service's real website directly (type the address in your browser; don't copy the link from the email).

Report it as phishing. In Gmail, open the message, click More next to Reply, then Report phishing. In Outlook, select the message and choose Report → Report phishing from the ribbon. This helps protect others.

Delete the email if it's still in your inbox. In Outlook, reporting it removes it from your inbox for you.

What to do if you clicked something

Don't panic, but act quickly.

Don't enter any credentials on the page you landed on.
Close the tab immediately.
If you already entered your password, change it right now on the real website.
If you entered 2FA codes, change your password immediately: the attacker likely has access.
Turn on two-factor authentication for that account if you haven't already. See Two-factor authentication, explained.
Run a malware scan if you downloaded anything. See Malware & your website explained.
Report it: forward the email to your email provider's abuse address, or use the "Report phishing" option.
Tell your IT contact or Chykalophia. It's better to report a false alarm than to leave a real compromise undetected.

Tell your team

If a phishing email got through to you, it likely got through to your whole team. Let them know as soon as possible so nobody else clicks it.

Common questions

How do phishers make emails look so real?

Attackers copy the exact design, logo, and wording of real companies' emails. They buy domains that look similar to legitimate ones, and they use legitimate email-sending services to avoid spam filters. Some attacks are very convincing. This doesn't mean you failed if you're unsure.

What is spear phishing?

Spear phishing is targeted phishing aimed specifically at you or your company. Instead of a generic "your account" message, it uses your name, mentions your company, references a real recent event, or even pretends to be from someone you know. It is much more convincing. See Business email compromise explained.

Can phishing happen by text or phone?

Yes. Text-message phishing is often called "smishing," and phone-call phishing "vishing." The same rules apply: create skepticism when something asks you to act urgently, and never provide credentials, codes, or payment information to someone who contacted you unexpectedly.

A colleague sent me an unusual email. Could their account be compromised?

Yes. Attackers who gain access to a business email account often use it to send phishing emails to the victim's contacts, because it's more convincing than a stranger's address. Call your colleague directly to verify before clicking anything.

How do attackers get my email address?

Email addresses are bought and sold on the internet. Your address may have leaked through a data breach, a website that sold your information, or simply by being listed publicly. This is unavoidable; what matters is recognizing phishing when it arrives.

I reported an email as phishing but it's still in my inbox. Did the report work?

It depends on the platform. Microsoft says Report → Report phishing in Outlook both reports the message and removes it from your inbox. Gmail's own steps for reporting phishing don't say the message leaves your inbox, so if it's still sitting there afterwards, just delete it.

Our email security says it has anti-phishing protection. Do I still need to be careful?

Yes. Anti-phishing filters catch many attacks, but not all. Sophisticated phishing emails can bypass automated filters. Human awareness is the last line of defence.

I got a suspicious email. Should I forward it to Chykalophia?

If it relates to your website, hosting, or domain, yes: forward it to us and we can check whether it is legitimate. For emails about other services (banking, email, etc.), contact those companies directly through their official websites.