How to spot a phishing email
A phishing email pretends to come from a company or person you trust, to get you to click, pay or sign in. The logo and the name shown are easy to copy. The sender's real address and the links are harder to fake.
Short answer. Look at the sender's full address, not just the name. Check that its domain (the part after the @) is the company's own. Be wary of a message that asks you to act fast, sign in, pay or confirm details through a link. If in doubt, contact the company through its own app or website. Run the checks on an address or a message: paste the whole email, with its From line.
The signs
Official advice from several countries agrees on the main signs:
- Pressure to act now. The UK's National Cyber Security Centre asks: "Are you told you have a limited time to respond (such as 'within 24 hours' or 'immediately')?" (NCSC, read 29 October 2026).
- A link to fix a payment or an account. The US Federal Trade Commission says "legitimate companies won't email or text with a link to update your payment information" (FTC, read 29 October 2026).
- A generic greeting, which the FTC also lists (FTC).
- Sender details that do not match. Australia's Scamwatch lists "The email's sender details do not match the legitimate business or government agency the message claims to be from" (Scamwatch, read 29 October 2026).
Do not rely on spelling mistakes: a well-written email can still be phishing.
The sender's address
Your email app shows a display name ("Netflix", "Tax Office") that the sender can set to anything. Tap or click the name to see the full address behind it.
- Read the domain, the part after the @. A company writes from its own domain: a bank's emails come from the bank's name, not from a free webmail address.
- Look for a look-alike domain: a letter changed, a word added (northbank-alerts.com for a bank at northbank.com), or the brand on the left of a stranger's name. Our guide to typosquatting lists the tricks.
- Check its age. A domain registered last week sending "your account" emails is a strong warning sign.
Our checker does these three steps when you paste the email with its From line. Only the domain leaves your device, never the name before the @ or the message.
Can the From line be faked?
Yes. The From line of an email is written by the sender, so a criminal can put a real company's address there. This is called spoofing.
Domain owners can publish records that tell other mail services which servers may send mail in their name. The main ones are SPF and DMARC. With DMARC, the owner can also say what receiving services should do with mail that fails the test (RFC 7489, the DMARC standard). A mail service that checks these records can send faked mail to spam, or refuse it.
Our checker reads whether a site's domain can receive email and has SPF and DMARC. A domain with no DMARC record is easier for others to fake. Normal causes: many small, honest sites never set up DMARC, so this is worth knowing, not a warning sign.
How to check an email is real
- Do not use the email's links, numbers or attachments to check it.
- Open the company's app, or type its address yourself, and look for the same message or alert there.
- Call the company on a number from its own website or from your card. Scamwatch advises contacting the organisation "using contact details you've found yourself" (Scamwatch, read 29 October 2026).
Report it
Reporting helps the warning lists catch the next copy. In the UK, forward it to [email protected]. In the US, forward it to [email protected], as the FTC advises. Each country we cover, with its sources: Who to tell, by country.
Where a product helps
- A password manager will not fill in your password on a fake sign-in page, because the address does not match. The UK's NCSC says the password "will only autofill on the correct website" (NCSC, read 29 October 2026). Many are free.
- Two-step sign-in (a code or a passkey as well as a password) is free with most accounts. It makes a stolen password much less useful.
- Security software can scan links and attachments in email. It catches known threats, not a well-made new message.
About this guide
Our checks that this guide explains: Sender's address, Email set-up. Each quote was read on the source's own page on the date shown. Legit Signals has no affiliate links: no company pays to be named here.
Last reviewed: 29 October 2026. Spotted an error? Tell us