How to Spot a Phishing Email in 10 Seconds (With Real Examples)

There's a huge difference between knowing, in the abstract, that phishing exists, and recognizing it in the ten seconds you actually get before deciding whether to click. Most security training stops at the first part. This guide focuses on the second: concrete, quickly verifiable signs you can apply without needing to be a technical expert.

Most email clients show a friendly display name — "Bank XYZ," "Tech Support" — that can be freely set by whoever sends the message, with no relationship to the actual email address behind it. Tapping or hovering over the sender's name almost always reveals the full address. An email claiming to come from your bank, but whose real address ends in a generic domain or one clearly different from the official one, is the fastest and most reliable signal there is.

"Your account will be suspended in 24 hours." "Suspicious activity detected, verify now." "Last chance to claim your refund." Phishing depends on you acting before you think, and artificial urgency is the most common tool for making that happen. Legitimate communications from serious institutions rarely push such aggressive deadlines for actions involving sensitive data or money.

Hovering over any link in an email (without clicking) reveals the actual destination URL in most email clients, usually in the bottom corner of the screen. If the link text says "Log in to your bank account" but the real URL points to a domain you don't recognize, or one that looks like the official one but with a swapped letter or an extra domain tacked on, it's phishing. This is probably the single most effective check of all.

Well-crafted, targeted phishing almost never has obvious spelling errors anymore — that signal, while still useful for generic mass phishing, isn't enough on its own anymore. What does still show up frequently are subtler inconsistencies: a logo slightly off in resolution or color from the official one, a footer with contact information that doesn't match the real company's, or a signature format that doesn't follow that organization's usual standard.

No legitimate financial institution asks, by email, for you to send your full password, your dynamic PIN, or your complete card numbers. If the email directly asks for information a real entity would never request through that channel, nothing else needs analyzing — it's phishing, no matter how convincing the rest of the message looks.

An email arriving about an invoice from a vendor you've never worked with, a shipping notification for an order you never placed, or a payment request tied to a contract that doesn't exist, are contextual signals that often get overlooked in the rush. Before acting on any email with financial implications, it's worth asking: does this make sense given what's actually happening in my work or life right now?

The most reliable verification doesn't happen inside the email itself — it happens outside it. If the email claims to be from your bank, don't use any link or phone number in the message; go directly to the official app or call the number you already had saved. If it claims to be a vendor requesting a bank detail change, call through an already-known channel to confirm before processing any payment — the variant we cover in detail in our guide on CEO fraud and business email compromise.

Don't reply, don't click any links, and report it to your IT or security team instead of just deleting it — every report helps identify patterns from campaigns targeting the organization. If you already clicked or entered information before realizing it, immediately change the affected credentials and notify the security team without delay; the faster you act, the smaller the exposure window.