Spot a Phishing Email Before You Click: 6 Red Flags (2026)

In 2015, phishing emails were easy to spot. Misspellings, bad grammar, a Nigerian prince who needed your bank details to move $40 million. Nobody fell for them except the unlucky few who were new to email.

In 2026, that is no longer true. Modern phishing emails are professionally written, visually identical to the real thing, and increasingly generated by AI. They come from real-looking domains, use the correct logos, and reference real transactions and real people.

Phishing is now the entry point for roughly 90 percent of successful cyberattacks. If you use email at all, you will encounter it. This guide is how to tell the difference.

What phishing actually is

Phishing is an attempt to get you to do one of four things:

• Enter your password on a fake login page that looks real
• Click a link that installs malware or a remote access tool
• Reply with personal information (card number, ID number, bank details)
• Approve a multi-factor authentication prompt that was triggered by an attacker

The goal is almost always one of two things: access to your money, or access to your accounts (which the attacker then uses to reach your money, your contacts, or your employer's systems).

Why password strength and phishing go together

The chart above shows how strong different kinds of passwords are. Long passphrases and random strings take years to crack by brute force. Short decorated passwords like "P@ssw0rd1" crack in hours.

But here is the uncomfortable truth: password strength does not protect you from phishing. A phishing email that tricks you into typing your password into a fake page defeats even a 100-character random password, because the attacker just reads it off the fake page and uses it on the real site.

This is why phishing is so dangerous, and why the habits below matter more than password complexity.

The red flags that actually matter

Modern phishing bypasses most of the old advice. Here is what to look for instead.

1. Urgency or threat

Phishing emails almost always create time pressure. "Your account will be closed in 24 hours." "Unauthorised login detected, verify immediately." "Payment failed, update your card now." The urgency is designed to override your critical thinking.

Real companies rarely send this kind of email. When they do, they do not ask you to click a link from the email. They tell you to log in to the app or the website directly.

2. A link that does not match the sender

This is the single most reliable signal. Hover over (or long-press on mobile) any link in the email before clicking. Look at the actual domain the link goes to.

A PayPal email that links to paypal-secure-login.com is fake. A Microsoft email that links to microsoft-verify.net is fake. The real domain always comes right before the first single slash. If the domain before the slash is not the exact company domain, do not click.

• paypal.com/login = real (paypal.com is the domain)
• paypal.com.secure-login.net/login = fake (secure-login.net is the domain)
• secure-paypal.com/login = fake (secure-paypal.com is the domain, and it is not PayPal)
• paypal.com.evil-site.com/login = fake (evil-site.com is the domain)

3. A generic greeting

Real companies know your name. If the email starts with "Dear Customer" or "Dear User," that is a warning sign. Some legitimate companies do use generic greetings, but combined with any other red flag, it is a strong indicator.

The reverse is also true: sophisticated phishing emails now use your real name because they buy it from data breaches. So a personalised greeting does not guarantee legitimacy either.

4. A request for information no legitimate company asks for

• Your password. No legitimate company ever asks for your password by email.
• Your full card number. Banks do not ask for this by email.
• Your one-time code or 2FA code. If a support agent asks you to read this out, they are a scammer.
• Your National ID or passport number. Almost never requested by email.
• Payment via gift cards, cryptocurrency, or wire transfer. Almost always a scam.

5. Unexpected attachments

Invoices, receipts, delivery notices, HR documents, scanned contracts. Attackers wrap malware in file types that look normal but execute code: .docm, .xlsm, .zip, .iso. If you were not expecting the attachment, do not open it. Call the sender to confirm.

6. Small visual differences

A logo that is slightly the wrong shade. A font that is almost right but not quite. A signature block that is formatted differently. Attackers often use screenshots of real emails and rebuild them imperfectly. If something looks slightly off and you cannot say why, trust the instinct.

The one habit that defeats almost every phishing attempt

Do not click links in emails or text messages. Ever.

This sounds extreme. It is not. Here is how to handle every email that asks you to do something:

1. Read the email. If it is a request to log in, update payment, verify identity, or take any account action, close the email.
2. Open the relevant app directly on your phone, or type the website address into your browser manually.
3. Log in there. If the request was real, you will see a notification inside the app.
4. If you see nothing, the email was phishing. Delete it.

This habit makes the entire "was this link real" question irrelevant. You never click the link, so it does not matter if it was real or fake. You always go to the real site directly.

The only exception: password reset emails you explicitly requested. If you did ask for a password reset thirty seconds ago, the link is safe. If you did not, treat it as phishing.

What to do if you already clicked

If you clicked a suspicious link and entered your password, act immediately. Every minute matters.

1. Change the password on that account immediately. Use a new, unique password. Do not reuse an old one.
2. Change the same password on any other site where you used it. If you reuse passwords, this is the cascade.
3. Enable two-factor authentication on the account if it is not already on.
4. Check for any unusual activity: sent emails, changed recovery options, pending orders, changed forwarding rules.
5. If a financial account is involved, call the bank directly using the number on the back of your card. Do not call any number from the email.
6. Check haveibeenpwned.com to see if the credentials show up in a breach in the coming weeks.
7. Run a full malware scan on your device if you downloaded or opened anything from the email.

Advanced defenses worth having

• A hardware security key (YubiKey, Titan). These are phishing-resistant: even if you type your password into a fake site, the key will refuse to authenticate to the wrong domain.
• A password manager that only autofills on the correct domain. If the URL is wrong, the manager will not offer to fill. This silently protects you from every phishing page.
• Email authentication at the server level. If you run a domain, set up SPF, DKIM and DMARC so attackers cannot easily spoof your address.
• A second email address for signups. If your main email is not publicly known, attackers have fewer phishing lists to reach you through.

The bottom line

Phishing is how almost every account compromise happens. It has nothing to do with password strength, and modern phishing is genuinely hard to detect by eye.

Do not try to spot phishing emails by inspection. Adopt the habit that defeats them all: never click a link in an email that asks you to log in, update payment, or verify identity. Go to the app or website directly. Every single time.

Add a password manager and a hardware security key on your two most important accounts, and you have made yourself a dramatically harder target than 99 percent of internet users.