What Is a Phishing Email?
A phishing email is a fake message that impersonates a real company or person. The word "phishing" comes from "fishing" — the scammer is casting a wide net hoping someone takes the bait.
- The email looks like it comes from your bank, Amazon, PayPal, the IRS, or a well-known company
- It creates urgency — "Your account will be closed," "Suspicious activity detected," "You have a package"
- It asks you to click a link and enter your username, password, or credit card number
- The link goes to a fake website that looks real but steals your information
Warning: Phishing is responsible for over 90% of data breaches. Even tech-savvy people fall for well-crafted phishing emails. The best defense is knowing what to look for.
Warning Signs of a Phishing Email
Most phishing emails have at least one of these red flags.
- The sender address does not match the company — "amazon-support@gmail.com" is not Amazon
- The email creates urgency or fear — "Act now or your account will be suspended"
- There are spelling mistakes or awkward phrasing that a real company would not use
- The greeting is generic — "Dear Customer" instead of your actual name
- Links in the email go to a different website than expected — hover over the link to see the real destination
- Attachments you were not expecting — especially .zip, .exe, or .doc files
- Requests for personal information — real companies never ask for your password by email
Tip: Hover your mouse over any link before clicking it. The real web address will appear in the bottom-left corner of your browser or email program. If it looks suspicious or does not match the company, do not click.
Common Phishing Email Examples
These are the most common types of phishing emails people receive.
- Bank alerts: "Unusual activity on your account — verify your identity now"
- Package delivery: "Your package could not be delivered — click here to reschedule"
- Amazon or PayPal: "Your order has been placed — click here to cancel if this was not you"
- IRS or government: "You owe back taxes — pay immediately to avoid legal action"
- Microsoft or Apple: "Your account has been compromised — sign in to secure it"
- Prize notifications: "You have been selected — claim your reward"
What to Do If You Receive a Suspicious Email
If something feels off about an email, trust your instincts.
- 1Do not click any links or open any attachments
- 2Do not reply to the email
- 3If the email claims to be from your bank or a company you use, go directly to their website by typing the address yourself — do not use the link in the email
- 4Call the company directly using a phone number from their official website to verify
- 5Mark the email as spam or phishing in your email program
- 6Delete the email
What to Do If You Already Clicked a Link
If you clicked a link and entered information, act quickly.
- 1Change your password on the affected account immediately
- 2If you entered banking or credit card information, call your bank right away
- 3Enable two-factor authentication on the account if you have not already
- 4Run a virus scan on your computer
- 5Check your other accounts — if you use the same password elsewhere, change those too
- 6Monitor your bank and credit card statements for unusual activity
Warning: If you entered your email password, change it immediately and check whether the attacker has set up email forwarding rules to copy your messages. Go to your email settings and look for any forwarding addresses you did not set up.