How to Spot a Phishing Email: 7 Simple Safe Checks

You open your inbox between meetings and see a message from your bank. It says your account will be blocked today unless you verify your details. Your heart skips a beat. Knowing how to spot a phishing email gives you a calm pause before you click.

This guide keeps things simple. You will learn seven quick checks, the mistakes people make when they are in a hurry, and what to do if you have already clicked. The examples come from India, where UPI alerts, bank messages and delivery notices are everyday targets for scammers.

What is a phishing email?

A phishing email is a message that pretends to be someone you trust, such as your bank, a government office, your employer or a courier company. Its goal is to make you act fast: open a link, download a file, or share a password or OTP. The same trick also arrives by SMS, WhatsApp and phone calls.

Phishing works because it targets feelings, not software. Fear, urgency and the hope of a reward make careful people rush. Once you see this, how to spot a phishing email becomes much easier, and a short checklist helps more than technical knowledge. If you run a team, our business data security checks cover the wider habits that keep a company safe.

How to spot a phishing email: 7 simple checks

Work through these in order. Most fake messages fail the first or second check, and the whole routine takes less than a minute.

1. Pause when the message feels urgent. Threats such as “account blocked in two hours” or rewards such as “claim your refund” are built to rush you. A real bank rarely needs an answer within minutes. Take one slow breath and do not click yet.
2. Look at the sender address, not only the name. Anyone can set the display name to your bank’s name. Tap the name to see the real address. Watch for small changes, such as an extra letter, a hyphen or an unrelated domain. Banks in India are moving to the exclusive .bank.in domain, so a bank message from a very different domain deserves a second look.
3. Check links before you click. On a computer, hover over the link to see where it really goes. On a phone, press and hold it. If the address does not match the company you expect, leave it alone. Shortened links hide the destination, so treat them with extra care.
4. Notice generic greetings and odd wording. “Dear customer” from a bank that knows your name is a clue. So are strange spellings or messy formatting. Polished fakes exist too, so use this as one clue, never the only one.
5. Be careful with attachments and QR codes. Unexpected invoices, resumes, tax files and “payment receipts” can carry malware. A QR code in an email can lead to a fake login page. Open nothing you were not expecting.
6. Never share OTPs, PINs or passwords. Banks, UPI apps and government offices do not ask for your PIN or OTP by email, SMS or phone. You enter a UPI PIN only to send money, never to receive it.
7. Verify through a second route. Close the message. Open your bank’s official app, or type the website address yourself, and look for alerts there. Call the number printed on your card or on the official website, never the number in the message.

If a message passes all seven checks but still feels wrong, trust that feeling and verify anyway. At work, forward the email to your IT team instead of deleting it. Our post on enterprise cloud security explains why one stolen login can reach so much more than a single mailbox.

Mistakes that make it harder to spot a phishing email

• Trusting the logo. Logos and colours are easy to copy. They prove nothing.
• Calling the number in the message. The number may belong to the scammer. Use the one on your card or the official site.
• Clicking “unsubscribe” on a suspicious message. It can confirm that your address is active.
• Checking only on a phone. Small screens hide the full sender address and link. Slow down and look closely.
• Reusing one password everywhere. A password manager and two-step verification limit the damage if one account is exposed.
• Staying silent out of embarrassment. Anyone can be fooled. Reporting early matters far more than pride.

Security works best as a daily habit, not a panic reaction. Knowing how to spot a phishing email is a habit you build, not a one-time lesson. Our DevSecOps guide shows how teams build small checks into normal work, and the same idea applies at home. For a calm way to treat alarming alerts, read how to respond to a critical vulnerability.

How to spot a phishing email: frequently asked questions

How to spot a phishing email on my phone?

Press and hold a link to preview its address, open the sender details to see the full email address, and avoid tapping anything urgent. When in doubt, open your bank’s official app instead of the message.

Can a phishing email harm my device without a click?

Usually it needs a click or an opened attachment. Some attacks use unpatched software, so keep your phone, browser and apps updated.

What should I do if I already clicked?

Do not enter anything further. Change the affected password from a device you trust, then call your bank on its official number and ask to block cards or UPI access if money is at risk. In India you can report online fraud at the National Cyber Crime Reporting Portal or call the helpline 1930. Organisations can also contact CERT-In, the national agency for cyber incidents. If the experience leaves you anxious or shaken, talking to someone you trust or a counsellor can help.

Are spam filters enough?

No. Filters catch many fake messages but not all of them. Your own pause, and knowing how to spot a phishing email, is the final layer of protection.

Final thoughts

Learning how to spot a phishing email does not make you a security expert. You only need a short pause, one extra check and the habit of verifying through a second route. Those three small steps stop most scams before they start.

Which scam message have you received lately, and what gave it away? Share it in the comments, without personal details, so others can learn from it.