Worried an email might be a scam? Here is how to spot phishing emails: look for urgency, requests for personal information, odd links and mismatched addresses, then verify through a channel you trust.
Phishing is one of the everyday risks that cuts across the types of technology you rely on, from email to online shopping.
| Item | Value |
|---|---|
| Phishing complaints in the FBI’s 2024 Internet Crime Report | 193,407 complaints |
| Phishing’s place among the most reported cybercrimes | Topped the list of the five most reported |
| Public sector breaches involving phishing (Verizon’s 2025 report) | 43% |
| Simple tips in CISA’s phishing guidance | Three: Recognize, Resist, Delete |
These figures come from CISA’s phishing training page for government organizations and its Recognize and Report Phishing page. Figures can change, so check the source before you rely on them.
Why phishing works and how common it is
Phishing happens when criminals try to get you to open harmful links, emails or attachments that could request your personal information or infect your devices. The messages are often designed to look like they come from a trusted person or organization, so that you respond.
Email is the classic route, but the bait can also arrive as a text, a direct message on social media or a phone call. CISA notes that most online attacks begin with a single click, and that criminals often use phishing to steal credentials, access accounts or install ransomware that locks systems and demands payment.
The scale is large. According to the FBI’s 2024 Internet Crime Report, phishing topped the list of the five most reported cybercrimes, with 193,407 complaints, and Verizon’s 2025 Data Breach Investigations Report found that 43% of the public sector breaches it investigated involved phishing, as CISA’s training page explains.
How to spot phishing emails: the warning signs
No single clue proves a message is fake, so you are looking for a pattern. The more of these signs a message shows, the less you should trust it.
- Urgent or emotional language, especially messages that claim dire consequences if you do not respond immediately.
- Requests for personal or financial information, such as login details or card numbers.
- Untrusted shortened URLs that hide where a link really leads.
- Incorrect email addresses or links, such as a look-alike version of a well-known brand name.
Do not count on spelling mistakes to give a scam away. A common sign used to be poor grammar or misspellings, but in the era of artificial intelligence some emails now have perfect grammar and spelling, so you should look out for the other signs.
Scams can also feel personal. Attackers may include personal or organization-specific details to make fake messages appear real, and messages may appear to come from known contacts whose accounts were compromised.
Be extra cautious with anything that appears to come from state or federal agencies, elected officials or law enforcement. CISA says these are commonly spoofed to gain trust.
What should you do with a suspicious message?
CISA boils the response down to three steps. They work for email and for other kinds of messages too.
- Recognize the warning signs listed above.
- Resist the urge to click links or attachments that seem too good to be true, and report the message instead.
- Delete the message without replying or opening anything.
To report, you will typically find options near the sender’s email address or username. You can also use the “report spam” button in the toolbar or settings.
When you delete, do not click anything inside the message. That includes any “unsubscribe” link, because CISA’s advice is simply to delete.
If the message might be real
Sometimes a message looks suspicious but could genuinely be from your bank or a shop. In that case, do not click any link or call any number in the message, and look up another way to contact the company or person directly.
- Go to the company’s website and take the contact details from the verified site.
- Search for the site in your browser, or type the address yourself if you are sure you know it.
- Use a different route to reach the person. If a friend sends a strange message on social media and you have their phone number, text or call to ask whether they sent it.
CISA’s guidance for government staff gives a similar tip: use a search engine to look up the business’s phone number rather than trusting the one in the message.
A real-world example of a phishing email
CISA describes a shopper named Omar who received an email that looked like it came from an online order. It said his payment had not gone through and that he needed to log into his account to approve the payment method.
The email included a shortcut link to a site that looked like the vendor’s and insisted he sign in immediately. Because he was in a hurry, Omar did not notice that the sender’s address was not from the vendor’s own domain and that the urgency was a login credential phishing tactic.
Hackers stole his password and credit card information and made purchases with his money. Omar eventually recovered most of his financial losses, although it took many hours on the phone with his bank and the retailer.
His lesson is a useful habit: when a message demands an immediate response, pause. Type the retailer’s web address yourself instead of clicking a link in an email.
Habits that make you harder to phish
Spotting a bad email is the first line of defence, but a few settings limit the damage if one slips through. CISA points to three basics.
- Strong passwords and a password manager help protect you from someone logging into an account and stealing data or money.
- Multifactor authentication (MFA) means using more than a password to access an app or account, such as a text code or a fingerprint.
- Software updates matter because flaws in software can give criminals access to files or accounts.
Be mindful of what you share, too. Revealing too much online can give criminals information they can use to phish you specifically.
Updates matter on every device you own, and for a wider view of connected gadgets you can read about what is the internet of things. For background on another everyday protection, see what is a vpn and how does it work.
Finally, if you work with others, make reporting easy. CISA recommends a no-blame culture so people report suspicious emails quickly, even if they have already downloaded malware or shared data.
Frequently asked questions
Can I rely on spelling mistakes to spot a phishing email?
Show answer
No. Poor grammar used to be a common sign, but CISA notes that some emails now have perfect grammar and spelling in the era of artificial intelligence, so check the other signs too.
Is it safe to click “unsubscribe” on a suspicious email?
Show answer
No. CISA advises you to delete the message and not to reply or click any attachment or link, including any “unsubscribe” link.
What if I think the message could be real?
Show answer
Do not click any link or call any number in it. Find the company’s contact details on its verified website, or contact the person another way to confirm.
Where do I report a phishing email?
Show answer
Check your email app for a report control beside the sender’s details, or for a spam-reporting button in its toolbar or settings. Reporting the message, rather than just ignoring it, helps protect you and others.
