Phishing Email Red Flags: A 10-Point Checklist
A phishing email usually fails at least two of ten checks: the sender address, the link destination, the greeting, the urgency, the request, the attachment, the reply-to address, the grammar, the context, and the channel. Score an email against the list below, and treat anything with three or more flags as unsafe until you confirm it another way.
The list is built for quick use. Each check takes seconds, and the order puts the easiest tests first.
The 10-point checklist
- Sender address. The display name can say anything. Open the full address and compare the domain to the real company. A message from "Support" at a domain that adds a hyphen or an extra word is a flag.
- Link destination. Hover over a link without clicking. On a phone, press and hold. If the address does not match the company's real domain, it is a flag.
- Greeting. A generic opener such as "Dear customer" from a company that knows your name is a mild flag.
- Urgency. Deadlines like "act within 24 hours" or "your account will be closed" are designed to stop you thinking. Urgency plus a request is a strong flag.
- The request. Be wary of any message asking for a password, code, card number, gift cards or a wire transfer. Real companies rarely ask for these by email.
- Attachment. Unexpected attachments, especially archives, HTML files, or documents asking you to enable macros, are flags.
- Reply-to address. Some messages show one sender and send replies to another. Check where a reply would go.
- Writing quality. Odd phrasing, mixed fonts and awkward formatting are a weaker flag. Modern scams are often well written, so do not rely on this check alone.
- Context. Did you expect this email? A delivery notice when you have ordered nothing is a flag.
- Channel. Does the message ask you to leave the platform, for example by moving to a messaging app or a phone call? That switch is a common tactic.
How to score it
Count the flags:
| Flags | What to do |
|---|---|
| 0 | Normal email. Proceed with usual care |
| 1 to 2 | Verify the request through a separate route before acting |
| 3 or more | Treat as phishing. Do not click, reply or open attachments |
This scoring is a practical rule of thumb, not a guarantee. Weight flags 4, 5 and 6 more heavily, because they are linked to the actions that cause harm. A single request for a password counts as three flags on its own.
Check the sender's domain
The part after the @ symbol matters most. Look at it carefully:
- Letters swapped or replaced: "paypa1" with a number one instead of the letter l.
- An extra word: "yourbank-support" instead of "yourbank".
- A different ending: ".co" or ".net" where the company uses ".com".
- Subdomains that hide the real one: "yourbank.login.example" belongs to "example", not to the bank.
Read the domain from right to left. The part just before the first slash or at the end of the domain is the real owner.
Check links safely
Never use a link in an email to log in to an account you care about. Open the company's website by typing the address or using a saved bookmark, then sign in there. If there is a real problem, the account page will show it.
If you do need to check where a link goes, use hover or long-press and read the full address. Shortened links hide the destination, so treat them with more caution. A password manager helps here too, because it only fills a login on the real site. If the manager does not offer your saved login, the page may be fake, which is one more reason to use a family password manager.
What to do if you clicked
Act within minutes if you clicked a link or opened a file:
- Close the page and do not enter anything further.
- If you typed a password, change it right away on the real site, and on any other site where you used it.
- Turn on two-step login for the affected account.
- Sign out other sessions from the account's security page.
- Check the account for new forwarding rules or changed recovery details.
- Watch for unusual activity on related accounts and bank statements.
If you gave card details, call the card issuer using the number printed on the card and ask them to block and replace it.
If you opened an attachment
Disconnect the device from the network if you suspect malware, run a full scan with your security software, and change important passwords from a different, clean device. Do not restart the file. If a work device is involved, report it to your IT team immediately.
Common scam types to recognize
- Delivery notices: a fake failed-delivery message asking for a small fee.
- Account alerts: a claim of suspicious activity with a link to "secure" the account.
- Invoice and payment changes: a supplier or colleague suddenly gives new bank details.
- Prize or refund offers: money you did not expect.
- Storage full warnings: a threat to delete photos unless you log in, which targets cloud photo accounts. Checking your real storage in the photo backup settings shows whether the warning is true.
The invoice case matters most for small businesses. Always confirm bank detail changes by phone using a number you already have.
Reporting a phishing email
Most email services have a Report phishing option in the message menu. Use it, then delete the message. Reporting helps the provider block the sender for other people. If the email pretends to be your bank or employer, forward it to their fraud or security address as well.
Teaching the checklist at home or at work
Pin the ten points near the computer, or save them as a note. Practice on a real email once a month. Ask each person to talk through the flags they see before anyone clicks. A team or family that checks aloud catches more than one person checking alone.
FAQ
Can I tell phishing by spelling mistakes alone?
No. Many scam emails are well written, and some legitimate emails contain mistakes. Check the sender domain, the link and the request first.
Is it safe to open a phishing email without clicking anything?
Opening is usually low risk in modern email apps, which block remote images by default. The danger comes from clicking links, opening attachments or replying. Delete it and report it.
What is the difference between phishing & spoofing?
Phishing is the attempt to trick you into giving information or taking action. Spoofing is faking the sender's name or address to make that attempt look real. Many phishing emails use spoofing.
What if the email came from someone I know?
Their account may be compromised. If the message asks for money, codes or a login, contact the person by phone or a separate channel before acting.
Using the list this week
Save the ten points as a note on your phone. The next time a message asks you to act, run the first five checks before anything else. If you ever hesitate, close the email and go straight to the company's site by typing the address.
