How to spot a phishing email before you click anything.

What these messages usually say

The FTC describes common phishing stories: the sender says it noticed suspicious activity or log-in attempts, claims there is a problem with your account or payment information, says you must confirm personal or financial information, or attaches an invoice you do not recognise. The FTC says the activity, the problem and the invoice are not real.

CISA lists two signs to watch for: urgent or emotionally appealing language, especially claims of dire consequences if you do not respond at once, and requests to send personal or financial information. A message does not need to contain both. One is enough reason to slow down.

Ask the first question before anything else

The FTC suggests asking whether you have an account with the company at all. If you do not, it is likely a scam, and you can stop there. If you do, the FTC says to contact the company using a phone number or website you know is real, not the details in the message.

CISA gives the same advice: if you think the message could be real, do not click any link or call any number in it. Look up another way to reach the company or person directly. In practice, that means typing the address you already use into your browser, or opening the app you already have installed.

A fictional example

Imagine a fictional email, “Your Example Shop payment failed”, that says your account will be put on hold today unless you click a button and update your card. You shop with a similar business now and then, but you cannot remember an account at Example Shop. The invented message uses a rush (“today”), a threat (an account hold) and a request for payment details.

Following the steps above, you would not click the button or call a number from the email. If you did have an account, you would open the shop yourself and look for a notice there. If there is none, the email was not telling you about a real problem. The shop, the message and the timing are all invented for illustration.

Warning signs to check

Do not use this list as a test that a message is safe. A message that avoids all of these signs can still be a scam, so rely on the independent check above rather than on how the email looks.

• The message pushes you to act immediately or warns of a penalty.
• It asks for personal or financial details, or says you must confirm them.
• It says there is a problem with an account, payment or log-in that you cannot verify elsewhere.
• It includes an invoice or order you do not recognise.
• The FTC also lists a generic greeting and a claimed account hold over billing as red flags.
• The FTC notes that legitimate companies will not ask you to click a link to update payment information.

Report it, then deal with the message

CISA says to report the phish to protect yourself and others, and that reporting options are typically near the sender’s name or address, or in a “report spam” button in the toolbar or settings. The FTC lists reportphishing@apwg.org for phishing emails, forwarding text messages to SPAM (7726), and ReportFraud.ftc.gov. These addresses may change, so use the FTC page for the current ones.

Do not forward a suspicious message to colleagues in a way that makes it easy to click. If you manage accounts for a team, tell the person responsible for them through your normal route.

If you already clicked

The two pages we read focus on recognising and reporting messages, and we did not find step-by-step recovery advice in them, so this guide does not give any. If you entered a password or payment details, open the real service directly, check your account and contact the company or your bank using details you already trust. The FTC lists multi-factor authentication, automatic updates and backups as general protections, but those reduce risk and do not undo a click.

Use this next

• Check the links in your article before publishing
• Sort your notifications by the task they serve
• Choose what to read before adding another feed