10 Signs of a Phishing Email and How to Report It

Last updated: October 8, 2026

Mock phishing email with five numbered callouts marking common red flags

Phishing is a scam where a criminal pretends to be a trusted company, colleague or friend to trick you into handing over passwords, payment details or personal information, or into installing malware. It usually arrives by email, but the same tricks are used in text messages, QR codes, social media messages and phone calls.

Some phishing emails are sloppy. Others look almost perfect. This guide covers ten warning signs, newer tricks to watch for, how to check whether a security alert is real, what to do if you already clicked, and exactly where to report a suspicious message in the US.

10 Signs of a Phishing Email

1. Urgent or threatening language

"Your account will be closed in 24 hours." "Suspicious activity detected, act now." Scammers create panic so you act before thinking. Real companies do sometimes send security notices, but they rarely demand you act within hours or threaten dire consequences by email. The Federal Trade Commission (FTC) lists claims of suspicious activity or log-in attempts, and claims of a problem with your account or payment information, among the most common phishing stories.

2. A sender address that does not match

The display name may say "Your Bank", but the real address behind it might be something unrelated or a lookalike. Check the full email address, not just the name. Watch for small changes like an extra letter, a swapped character, or an unusual domain ending. Note, though, that scammers can also fake ("spoof") sender addresses, so this check alone is not enough.

3. Links that go somewhere else

On a computer, hover your mouse over a link without clicking, and the real destination appears in the corner of the window or a small pop-up. On a phone, pressing and holding a link usually shows a preview. If the address looks unrelated to the company, or is a shortened link, do not click it.

4. Generic greetings

"Dear customer" or "Dear user" in a message that claims to come from a company that knows your name can be a sign. This is not proof on its own, since some real emails are generic, and some phishing emails do use your name.

5. Requests for sensitive information

Legitimate companies do not ask you to send passwords, full card numbers, PINs or one-time verification codes by email or text. If a message asks for any of these, treat it as suspicious. The FTC adds that legitimate companies won't email or text you a link to update your payment information.

6. Unexpected attachments

Invoices, "scanned documents", shipping labels and voicemail notices you were not expecting are a favorite way to spread malware. Be especially careful with files that ask you to "enable macros" or "enable content", and with compressed or unusual file types.

7. Too-good-to-be-true offers

Surprise prizes, unexpected refunds, easy jobs or inheritance stories are designed to trigger excitement and lower your guard. If you did not enter a contest, you did not win it. The FTC specifically warns about messages saying you are eligible for a government refund, and coupons for free stuff.

8. Spelling, grammar and formatting oddities

Poor writing can be a clue, but do not rely on it. Modern tools make it easy to write polished messages, so the absence of typos does not mean an email is safe. Look for logos that are blurry, layouts that look off, or wording that does not sound like the company.

9. A login page that does not look right

Some phishing emails lead to a page that copies a real sign-in screen. Check the address bar. The site address should be exactly the company's real domain. A padlock icon alone does not prove a site is legitimate, because criminals can also obtain secure certificates for fake sites. If in doubt, close the page and type the website address yourself, or open the official app.

10. Unusual requests from someone you know

A message from a boss, relative or friend asking for gift cards, a bank transfer, or "a quick favor" can come from a hacked or impersonated account. Confirm through a different channel, such as calling them on a number you already have.

Newer Phishing Tricks to Watch For

QR codes instead of links ("quishing")

Because people have learned to be wary of links, some scammers put the link inside a QR code. The FTC warns that scammers send QR codes by email or text with a made-up reason to scan them, such as a missed package delivery, a problem with your account, or suspicious activity that requires a password change. In a September 2026 alert, the FTC also noted reports of scammers covering legitimate QR codes on parking meters with their own.

The FTC's advice from its QR code alert: don't scan a QR code in an email or text you weren't expecting, especially if it urges you to act immediately; inspect the link preview for misspellings or switched letters before opening it; and if you think the message might be real, contact the company using a phone number or website you know is genuine.

Fake "security team" messages and calls

Some phishing emails are only the first step. The message tells you to call a "support" number, and the person who answers walks you through handing over a code or changing a setting. Apple says it will never ask you to log in to any website, tap Accept in a two-factor authentication prompt, provide your password, device passcode or two-factor code, or disable a security feature such as two-factor authentication or Stolen Device Protection. Treat any such request as a scam, whoever it claims to be from.

Look-alike alerts about your password

Messages saying "your password was found in a data breach" can be real or fake. Do not use the link in the message. Open your password manager or the service's website yourself and check there. Our guide to what to do when your email shows up in a data breach explains how to verify a breach notice.

Phishing texts follow the same patterns. Our guide to fake text messages and delivery scams covers the text-message versions, including fake USPS notices.

How to Check Whether a Security Alert Is Real

The safest rule is to never act on the message itself. Check through a route you control:

Google: Google says that if you think a security email that looks like it is from Google might be fake, you can go directly to myaccount.google.com/notifications to see your account's recent security activity. Google also says that if you are signed in, emails from Google won't ask you to enter the password for that account.
Apple, Microsoft, banks and stores: open the official app, or type the website address yourself, and look for the same alert in your account's security or messages section.
A person you know: call or text them on the number you already have, not one in the message.

The FTC suggests one simple question before you click anything: do I have an account with this company, or know the person who contacted me? If the answer is no, it could be phishing. If the answer is yes, contact them using a phone number or website you know is real, not the information in the message.

What to Do When You Get a Suspicious Email

Stop. Do not click links, scan QR codes, open attachments or reply.
Verify independently. Go to the company's official website by typing the address yourself, or use its official app or phone number from a trusted source, such as your card.
Report it (see the section below).
Delete it after reporting.

What to Do If You Already Clicked

Do not panic; it happens to many people. Act calmly and quickly. If your email account may have been accessed, see how to tell if your email has been hacked, and if it was a Google account, our guide to recovering a hacked Gmail or Google account.

If you only clicked a link and nothing else, close the page. Run a security scan and keep your browser updated.
If you entered a password, change it immediately on the real website, and anywhere else you used it. Enable two-factor authentication. Sign out of other sessions if that option exists; our guide to checking which devices and apps have access to your account shows where to do this for Google, Microsoft and Apple.
If you entered card or bank details, call your bank using the number on your card or the official website, and ask about blocking the card and reviewing transactions.
If you gave your Social Security number or other identity details, the FTC says to go to IdentityTheft.gov, which shows the specific steps to take based on the information you lost.
If you opened an attachment or installed something, the FTC advises updating your security software, running a scan and removing anything it flags. Disconnect from the internet while you do this, consider getting help from a trusted professional, and change important passwords from a different, clean device.
Watch your accounts for unusual activity in the coming weeks.

Tools such as Malwarebytes can provide a second opinion scan, alongside the security features built into your operating system.

How to Report Phishing

Reporting helps providers block the scam for other people. The table below lists official reporting routes; details can change, so check the linked help pages if a button has moved.

What you received	Where to report it	How
Phishing email in Gmail	Google	On a computer, open the message, click More (next to Reply), then Report phishing
Phishing email in Outlook.com	Microsoft	Select the message, then Report, then Report phishing. Microsoft notes this reports the sender but does not block them; add the sender to Blocked senders as well
Email pretending to be Apple	Apple	Forward it to reportphishing@apple.com
Email pretending to be the IRS or Treasury	IRS	Send it to phishing@irs.gov with "IRS" (or "Treasury") in the subject line, ideally using Forward as attachment
Any phishing email	Anti-Phishing Working Group	Forward it to reportphishing@apwg.org
Phishing text message	Your wireless carrier	Forward it to 7726 (SPAM)
Any phishing attempt	FTC	Report it at ReportFraud.ftc.gov
You lost money or data	FBI and FTC	File with the FBI's IC3 at ic3.gov, and use IdentityTheft.gov for a recovery plan

Use your email provider's report button

Most email services have a "Report phishing" or "Report spam" option, usually found in the message's menu (often three dots) or the spam button. Gmail, Outlook and Yahoo all offer some version of this (see Google's page on avoiding and reporting phishing emails and Microsoft's page on phishing in Outlook). Use it instead of only deleting the message.

Report to the impersonated company

Many companies have a dedicated address or web page for reporting scam messages that use their name. Look for it on their official website. Apple, for example, lists reportphishing@apple.com on its scam guidance page, and the IRS explains its process on its page for reporting fake IRS emails and messages. The IRS notes that it never emails you without your permission and does not send text messages without your permission.

Why "forward as attachment" matters

The IRS points out that a normal forward strips data that helps identify the scammer. If your email program has a Forward as attachment option, use it when an organization asks for the original message.

Report to authorities

United States: the Federal Trade Commission accepts reports at reportfraud.ftc.gov. Emails can also be forwarded to reportphishing@apwg.org, which is run by the Anti-Phishing Working Group.
Phishing texts: forward the message to 7726 (SPAM), which helps your wireless provider block similar texts, as the FTC explains in its guide to reporting spam text messages.
Money or identity lost: if you paid a scammer or shared sensitive details, also file a report with the FBI's Internet Crime Complaint Center (IC3). CISA's guide to recognizing and reporting phishing explains how to report from your email program.

Never forward a suspicious email to a random person or post its links publicly, as others may click them.

How to Protect Yourself Going Forward

The FTC recommends four layers: security software set to update automatically, automatic updates on your phone, multi-factor authentication on your accounts, and regular backups of your data. On top of that:

Use strong, unique passwords, as explained in our guide to creating a strong password you can remember.
Turn on two-factor authentication, preferably with an app or security key, so a stolen password is less useful. Passkeys go further, because they will not work on a fake site's address.
Use a password manager. Many managers only autofill on the correct website, which can help you notice a fake login page. Our comparison of free password managers can help you pick one.
In Chrome, Google suggests using Safe Browsing, with Enhanced Protection for additional protections, to get warnings about phishing and unsafe sites.
Bookmark the sites you use for banking and shopping, and use those bookmarks.
Slow down when a message makes you feel rushed or scared.

Frequently Asked Questions

Can I get hacked just by opening a phishing email?

It is uncommon, and most damage comes from clicking links, opening attachments or entering information. Still, avoid opening suspicious messages when you can, and keep your software updated.

What is the difference between phishing and spam?

Spam is unwanted bulk mail, often advertising. Phishing is a deliberate attempt to deceive you into giving up information or access.

What is spear phishing?

It is a targeted phishing attack tailored to a specific person or organization, often using personal details to seem believable. Apple notes that scammers often mention private-seeming details, such as your address or employer, to build trust.

Is it safe to scan QR codes?

QR codes themselves are just a way to deliver a link. The risk is where the link goes. Check the preview before opening it, and don't scan codes from unexpected emails or texts, or codes stuck over a parking meter's original label.

Does marking an email as phishing block the sender?

Not always. Microsoft says that in Outlook.com, reporting a message as phishing reports the sender but does not block them, so add the address to your blocked senders list if you want to stop future messages.

Does a VPN protect me from phishing?

No. A VPN encrypts your internet traffic and hides your IP address from sites, but it does not stop you from being tricked by a fake message.

Are phishing texts and calls the same thing?

The tactic is the same. Text versions are often called smishing and phone versions vishing.

Related Guides

Conclusion

The best defense against phishing is a habit: pause before you click or scan, check the sender and link, and verify through an official channel. If something slips through, change passwords, contact your bank if needed, and report the message to your email provider, the impersonated company and the FTC. Sharing these signs with family and friends can protect them too.