Updated
How to Spot a Phishing Email – and Check If an Email Is Legit
Head of Product & Co-Founder
Reviewed by Argjent Sahiti
CTO
To spot a phishing email, check who really sent it, where its links go, and whether it pushes you to act right now. Phishing emails are designed to look real and make you act before you think. A few habits are enough to tell most of them apart from the real thing.
Key takeaways
- Check the actual sender address, not just the display name. A trusted brand name can hide a fake domain like paypa1.com.
- Hover over a link before clicking. If the real URL doesn't match what's shown, the email isn't from a legitimate source.
- Never update payment details through an email link. Log in through the app or website you normally use instead.
- If you don't have an account with the sender, treat the email as phishing, report it and delete it.
- If you gave out financial or identity details, go to IdentityTheft.gov for guidance based on what you shared.
How to tell if an email is from a scammer
Phishing emails are built on deception. The scammer impersonates a company or institution you trust, such as a bank, a payment platform or a government agency, and uses that trust to get your credentials, account numbers or personal information. If it works, they can get into your accounts directly or sell your data to other bad actors.
The tactics change constantly, but the patterns underneath stay the same.
The message creates urgency without context
Unexpected emails about suspicious activity on your account, billing problems or requests to verify personal information are among the most common phishing signals. Legitimate companies generally don't send urgent demands to update payment details through an email link. If a message wants you to act immediately, slow down.
Common phishing stories include:
- Alerts about suspicious log-in attempts that never actually happened
- Claims that your account is on hold because of a payment issue
- Requests to confirm personal or financial information
- Invoices for purchases you never made
- Links to make payments
- Notices about government refunds you're supposedly eligible for
- Offers of free products or coupons
Each one is designed to create a moment of confusion or anxiety that overrides your judgment. Recognizing that mechanism is your first defense.
Also read: Understand the different types of exposure
Warning signs that an email is a scam
Checking whether an email is legit comes down to the details scammers tend to get wrong, or get almost right.
| Warning sign | What it looks like | What to do |
|---|---|---|
| Generic greeting | Dear Customer or Dear User from a company you have an account with, which usually addresses you by name | Treat it as a red flag and look closer |
| Sender address slightly off | A trusted brand in the display name but an odd domain, such as support@paypa1.com instead of paypal.com | Check the actual email address, not the display name |
| Link doesn't match the context | The URL shown when you hover differs from what the email displays | Don't click; a mismatch is a reliable sign the email isn't legitimate |
| Request to update payment details by link | A button or link asking you to fix billing information | Log in through the app or website you normally use and check for a notice there |
Table: Common phishing warning signs, what they look like and what to do about each.
An email can use a company's logo, match its visual style and mention real details about you and still be a scam. Phishing attempts can be very polished. When in doubt, go to the company's website by typing the address yourself.
How to protect yourself from phishing attacks
Spotting a phishing email is one layer of defense. Some structural protection means fewer threats reach you in the first place, and less damage if one gets through.
Some attacks skip email entirely and try to sit between you and a real site, which our guide to how man-in-the-middle attacks work explains.
Step 1: Use and maintain security software
Security software is your technical baseline. Set it to update automatically so it handles new threats as they appear, without you having to remember.
Step 2: Keep your devices updated
Software updates often contain critical security patches. Turn on automatic updates on both your computer and your phone. It's one of the lowest-effort, highest-impact habits there is.
Step 3: Turn on multi-factor authentication
Multi-factor authentication (MFA) asks for more than a password before it lets anyone into your account. The extra credential falls into one of three categories.
| Factor | Examples |
|---|---|
| Something you know | A PIN, passcode or answer to a security question |
| Something you have | A one-time code from an authenticator app or text message, or a physical security key |
| Something you are | A fingerprint, face scan or retina scan |
Table: The three kinds of credentials multi-factor authentication uses.
Even if a scammer gets your username and password through phishing, MFA puts a barrier in front of your account that they can't easily get past.
Step 4: Back up your data
Back up your computer to an external drive or cloud storage, and do the same for your phone. It won't prevent phishing, but if something does go wrong, your data isn't held hostage.
Also read: How to protect yourself and your data from internet hackers
What to do if you suspect a phishing email
Ask one question: do you have an account with this company, or do you know the person who contacted you?
If the answer is no, treat it as phishing. Check it against the warning signs above, report the message and delete it.
If the answer is yes, don't use the contact details in the email. Look up the company's official phone number or website yourself and verify the message through a channel you trust. Attachments and links in phishing emails can install malware silently, with no visible sign that anything happened.
What to do if you responded to a phishing email
If you already clicked a link, opened an attachment or handed over sensitive information, act quickly.
If you're not sure whether anything got in, our list of signs you've been hacked shows what to check on your accounts and devices.
- If you gave out financial or identity information, such as a credit card number, bank account details or a Social Security number, go to IdentityTheft.gov for specific guidance based on what you shared.
- If you clicked a link that may have installed harmful software, update your security software so it has the latest definitions, then run a full scan and remove anything it flags.
How Serus reduces what scammers know about you
Phishing is one piece of a larger picture. The more of your personal information circulates online, the easier you are to target, and scammers use that data to make their emails more convincing.
Serus looks wherever your data shows up, including data brokers, people-search sites and the dark web. It removes your data from the public sources where it can be taken down and keeps checking for re-listings. For the dark web and breach databases, it monitors and alerts you when your data appears, so you know which accounts to secure. Less exposed data means less material for the next convincing phishing email.
Questions
Can a phishing email use a real company's logo?
Yes. An email can use a company's logo, match its visual style and mention real details about you and still be a scam. When in doubt, go to the company's website by typing the address yourself.
Is a greeting like Dear Customer a sign of phishing?
It's a red flag. Companies you have an account with usually address you by name, so a generic greeting such as Dear Customer or Dear User deserves a closer look.
What do phishing emails usually claim?
Common stories include alerts about log-in attempts that never happened, accounts on hold over a payment issue, invoices for purchases you never made, government refunds and free products or coupons. Each one is meant to make you act before you think.
Does multi-factor authentication help if I fall for a phishing email?
Yes. Even if a scammer gets your username and password through phishing, multi-factor authentication puts a barrier in front of your account that they can't easily get past.
What should I do if I clicked a link in a phishing email?
Update your security software, then run a full scan and remove anything it flags. If you also handed over financial or identity information, visit IdentityTheft.gov for guidance.
Author
Anthon WanslandHead of Product & Co-Founder
Shapes the Serus product — from the first address-removal service to the platform it is today.
Reviewed by
Argjent Sahiti
