Learn to spot fake emails from scammers impersonating banks, Amazon, PayPal, and government agencies
Check the sender's email address (not just the display name), hover over links without clicking to see real URLs, and look for urgency tactics. Real companies never ask for passwords via email. When in doubt, go directly to the company's website (don't click email links) or call their official number.
Phishing is a cyberattack where scammers send fraudulent emails pretending to be trusted companies (banks, Amazon, PayPal, government agencies) to steal your personal information, passwords, or money.
Phishing works by exploiting trust and urgency. Scammers know you'll act quickly if you think your bank account is compromised or your Amazon order is delayed.
If an email has even ONE of these red flags, treat it as suspicious:
The #1 way to spot phishing: Check the actual email address, not just the display name.
How to check: Click on the sender's name to reveal the full email address. Scammers can make the display name say "PayPal" but the actual address will be fake.
Legitimate companies use your name. Phishing emails use generic greetings because scammers don't know who you are.
Phishing emails create false urgency to make you act without thinking.
Reality check: Legitimate companies give you reasonable time to respond and offer multiple contact methods. They don't threaten immediate account closure.
NEVER click links in suspicious emails. Instead, hover your mouse over the link (don't click!) to see where it really goes.
What you see: "Click here to verify your account: www.paypal.com/verify"
Where it actually goes: paypa1.secure-login.tk (notice the "1" instead of "l")
Red flag URLs:
CRITICAL RULE: Legitimate companies NEVER ask for these via email:
Many phishing emails come from non-English speakers or use automated translation, resulting in awkward phrasing.
"Dear valued customer, we has detected unusual activity on you're account. Please to verify your informations immediately or account will be suspend."
However: Some sophisticated phishing emails have perfect grammar. Don't rely on this alone!
NEVER open attachments from unexpected emails, even if they appear to be from known companies.
Subject: "Unusual Activity Detected on Your Account"
Claims: Suspicious charges, need to verify identity, account will be locked
Reality: Banks contact you through secure messages in your online banking portal, not email
Subject: "Your Amazon Order Cannot Be Delivered"
Claims: Payment issue, address problem, need to update info
Reality: Check your Amazon account directly (don't click email links)
Subject: "Verify Your PayPal Account to Avoid Suspension"
Claims: Account limited, need to confirm identity
Reality: PayPal never asks you to verify via email links
Subject: "You Have a Tax Refund Pending"
Claims: Refund available, click to claim
Reality: IRS NEVER initiates contact via email. They send physical letters only.
Subject: "Your Microsoft Account Has Been Compromised"
Claims: Security breach, need to reset password
Reality: Go directly to microsoft.com or apple.com to check account status
Click on the sender's name to reveal the full email address. Compare it to the company's official domain.
Open a new browser tab and type the company's URL directly (google.com, amazon.com, etc.). Log in normally and check for messages.
Place your mouse over any links to see the real destination URL. Does it match the official website?
Use the phone number on your credit card, bank statement, or the official website. DON'T use numbers in the suspicious email.
Log in to your account through the official app or website. Real alerts will appear there too.
Don't panic, but act fast. Here's what to do:
Simply clicking a link usually can't install malware on modern devices unless you also downloaded and ran a file. The main risk is if you entered information on the fake website.
Reporting phishing emails helps email providers improve spam filters and helps authorities track and shut down scam operations. Your report could prevent others from falling victim.