How to Spot a Phishing Email Before You Type Your Password

The email looks like it came from your bank. The logo is right, the colours are right, and it says your account will be locked within 24 hours unless you confirm your details. Your thumb is already moving toward the link.

That moment — right before you type anything — is where phishing is actually beaten. It takes about thirty seconds of deliberate checking. Phishing works because it borrows trust from names and logos you already believe in. It rarely survives a close look at the details.

Start with the sender address, not the display name

The name shown in your inbox is free to fake. Anyone can set a display name to "PayPal Service" or "HR Department" while sending from an address they control. On a phone, tap the sender name to reveal the full address. On desktop, hover over it or open the message header.

Then read the domain — the part between the @ and the first single slash — and look at what sits immediately before the final dot. In the address service@paypal-secure-billing.com, the real domain is paypal-secure-billing.com, not paypal.com. Hyphens, extra words, and endings like .info, .support or .net glued onto a well-known brand are warnings, not decoration.

Also watch for character swaps designed to fool a quick glance: a lowercase L for a capital I, a zero for the letter O, or "rn" standing in for "m". And check the reply-to field when you can. If replies go somewhere different from the visible sender, something is wrong.

Urgency is the engine of nearly every phish

Pressure exists to shorten the time you spend thinking. The most common versions threaten loss of access, a suspicious login, an unpaid invoice, a parcel held at customs, or a refund that expires. Here is a typical one:

Dear Customer, we detected an unauthorised sign-in to your account. For your protection, access has been limited. Restore access within 12 hours or your account will be permanently closed. Verify Now.

Four things stand out. A generic greeting. A short deadline. A consequence that sounds final. And a vague action button instead of a specific instruction. Real security notices do exist, but they tend to tell you what happened, when, and what to do next time you log in normally — they do not push you through a link to prevent permanent closure within hours.

Urgency can also point the other way: an unexpected refund, a bonus, a prize, or a "final notice" about a delivery. Anything designed to make you act before you think deserves more thinking, not less.

Read the link before you click it

The underlined text you see is a label, not a destination. Hover over a link on a computer to preview the real address in the corner of your browser, or press and hold on a phone to see where it leads. Never click just to find out where it goes.

What should concern you:

• A long chain of subdomains, such as login.yourbank.com.secure-verify.account-check.net. Only the last part before the slash belongs to the sender.
• Shortened links from services like bit.ly or tinyurl, which hide the destination entirely.
• Redirect parameters — anything after ?url= or ?redirect= — carrying an address that has nothing to do with the company named in the email.
• A padlock icon treated as proof of honesty. The padlock means the connection is encrypted. It says nothing about who is on the other end.

If the message claims there is a problem with an account, ignore its link. Open a new tab, type the address yourself, or use a bookmark you saved earlier. That single habit defeats most credential-stealing pages.

The requests that should never arrive by email

Some things simply do not belong in an inbox, no matter how official the message looks. Treat any of these as a hard stop:

• A request to reply with your password, PIN, or a one-time code. Codes expire in seconds precisely because they are meant to be typed into the real site, not shared with a person.
• An instruction to re-enter your full card number, security code, or bank login by following a link.
• A message from an executive or supplier asking for an urgent payment, a change of bank details, or gift cards bought and photographed. Verify by phone using a number you already have.
• An unexpected attachment, especially an invoice, a scanned document, or a file ending in .html, .zip or .htm that opens a login page.

When money or contracts are involved, confirm by voice with a number you looked up independently, not one printed in the email. If a payment has already gone out, call your bank's fraud line straight away. For anything with legal or contractual consequences, speak to a professional rather than trusting an email thread.

The quieter tells, and why typos are not enough

Formatting and tone

Odd spacing, mixed fonts, a footer that does not match the company, missing unsubscribe text, or a greeting that flips between "Dear Customer" and your first name. Your name appearing correctly proves nothing — breached contact lists are widely traded. The same goes for typos: plenty of phishing is cleanly written and professionally designed, so use grammar as one signal among several, never as your only test.

Timing and context

Does the message fit reality? An invoice from a supplier you have never used, a delivery for an order you did not place, or a security alert moments after you logged in without trouble. Ask whether the email expects you to know something you never did.

What to do when something feels off

1. Stop. Do not click, reply, or call any number printed in the message.
2. Verify separately. Open the company's site by typing the address or using an app, and check your account there.
3. Report it. Use your mail provider's "Report phishing" option, and forward it to your IT or security team if it arrived at work.
4. If you clicked but typed nothing, close the tab and run a scan if you downloaded or opened a file.
5. If you did type your password, change it on the real site immediately, change it anywhere you reused it, enable two-factor authentication, and review recent sessions and forwarding rules.
6. Expect a follow-up. A second message that references the first, offering to "help", is a common next step.

Make the pause automatic

The check is short: sender domain, link destination, the reason you are being asked, and the urgency. If any of the four feels wrong, close the message and reach the company another way.

Two habits make this easier over time. Use a password manager, because it will not autofill your credentials on a lookalike domain — that silence is a useful warning. And keep two-factor authentication switched on everywhere it is offered, ideally through an authenticator app or a hardware key rather than text messages. Phishing targets the moment before you type. A few seconds of suspicion is often the whole defence.

Photo: Brett Jordan / Pexels