How to Block Phishing Emails & Spoofed Senders

Phishing emails and spoofed senders are among the most common ways attackers trick people into revealing passwords, financial details, or installing malware. This guide walks you through practical steps to block these threats and harden your inbox, covering built-in email tools, security settings, and good habits. You’ll learn how to spot red flags, report suspicious messages, and set up filters so fewer scams reach you.

What You’ll Need

• Access to your email account settings (webmail or desktop app)
• Your email provider’s help documentation (Gmail, Outlook, Yahoo, etc.)
• Optional: a password manager to create and store strong, unique passwords

Step-by-Step

1. Learn to spot phishing signs. Before blocking, know what to look for: urgent language, unexpected attachments, mismatched sender addresses, generic greetings, and links that don’t match the displayed URL. Hover over links (without clicking) to see the real destination. If an email asks for personal info or credentials, treat it as suspicious.
2. Use your email provider’s built-in report/spam button. Most providers (Gmail, Outlook, Yahoo, etc.) have a “Report phishing” or “Report spam” option. Select the suspicious email, click the report icon, and choose the right category. This trains the provider’s filters and helps protect other users.
3. Block the sender manually. Open the suspicious email, click the three-dot menu (or right-click), and select “Block sender” or “Block”. This moves future emails from that address to spam or blocks them entirely. Note that attackers often change addresses, so this is a short-term fix.
4. Create a filter to auto-delete or label. In Gmail, go to Settings > Filters and Blocked Addresses > Create a new filter. Enter the sender’s email or domain (e.g., @example.com) and choose actions like “Delete it” or “Skip the Inbox (Archive it)”. In Outlook, use Rules > Manage Rules & Alerts. This is more robust than blocking a single address.
5. Enable SPF, DKIM, and DMARC checks (if you control your domain). If you own the domain, these authentication protocols verify that emails claiming to be from your domain are legitimate. You can set them up in your DNS provider. This won’t block incoming phishing, but it prevents your domain from being spoofed to others.
6. Turn on enhanced phishing protection in your email client. Gmail has “Enhanced Safe Browsing” in Google Account settings. Outlook has “Junk Email Filter” levels (Low/High) and “Safe Senders” lists. Enable these to get more aggressive filtering.
7. Use a password manager and enable two-factor authentication (2FA). Even if you click a phishing link, a password manager won’t autofill credentials on a fake site. 2FA adds a second layer that attackers usually can’t bypass. Set this up on your email account and other important accounts.
8. Keep your software updated. Update your email app, browser, and operating system. Updates often include security patches that close vulnerabilities exploited by phishing links.

Common Mistakes

• Relying only on blocking the sender. Attackers change addresses constantly; blocking one address is ineffective long-term. Use filters and reporting.
• Clicking links to “unsubscribe” from phishing emails. This often confirms your email is active, leading to more spam. Only unsubscribe from legitimate newsletters you subscribed to.
• Ignoring the difference between “Report Spam” and “Report Phishing.” Spam is unsolicited but not malicious; phishing attempts to steal info. Reporting phishing helps providers improve security.
• Not checking the full email header. Spoofed senders can display a fake name, but the actual email address (in the header) may reveal the true source. Learn to view full headers in your client.
• Disabling security warnings. If your browser or email client warns about a suspicious link, don’t click “Ignore” or “Continue anyway.”

Tips

• Use a separate email for sign-ups. Keep your primary email for important contacts; use a secondary address for newsletters and online shopping.
• Check the “To” field. If the email isn’t addressed to you specifically (e.g., “Dear Customer”), that’s a red flag.
• Verify unexpected attachments. If you get an attachment from a known contact but weren’t expecting it, call them to confirm before opening.
• Enable “Show external images” only for trusted senders. Some phishing emails use tracking pixels to confirm your address is active.
• Use a browser extension that blocks malicious sites. Many security suites offer free extensions that warn about known phishing domains.
• Regularly review your “Sent” folder. If you see emails you didn’t send, your account may be compromised—change your password immediately.

Troubleshooting

If a phishing email still lands in your inbox despite your efforts, or if you accidentally clicked a link:

• If you clicked a link but didn’t enter info: Close the tab, clear your browser cache, and run a security scan. Change your passwords for that site and any other accounts you use.
• If you entered your password: Change that password immediately, enable 2FA, and check for unauthorized activity. If you reused the password, change it on all accounts that use it.
• If the email looks like it’s from a legitimate company but you’re unsure: Don’t reply. Contact the company directly using their official website or phone number (not the one in the email).
• If your filters aren’t catching everything: Add more specific rules—for example, filter by domain or content keywords. Also, report the email as phishing so the provider can update its filters.
• If you’re getting too many false positives (legitimate emails flagged as spam): Add trusted senders to your address book or safe senders list. Check your spam folder regularly and mark legitimate emails as “Not spam.”

Frequently Asked Questions

How do I know if an email is really from my bank?

Banks never ask for passwords or PINs via email. Check the sender’s full address, hover over links, and call your bank using the number on your card or statement.

What is the difference between spam and phishing?

Spam is unsolicited bulk email (often ads). Phishing is a targeted attempt to trick you into revealing sensitive info or downloading malware. All phishing is spam, but not all spam is phishing.

Can I block an entire domain (e.g., @example.com)?

Yes, most email clients allow you to create a filter that deletes or archives emails from a specific domain. Be careful not to block legitimate domains that may be used by services you use.

Will reporting phishing emails really help?

Yes. Providers use these reports to improve their spam filters and block similar messages for all users. It also helps take down malicious sites.

What should I do if I already clicked a phishing link?

Disconnect from the internet, run a full antivirus scan, change your passwords from a different device, and enable 2FA. Monitor your accounts for unusual activity.

Are phishing emails only sent via email?

No, phishing can also come via SMS (smishing), phone calls (vishing), or social media messages. The same principles apply: don’t click suspicious links and never share personal info unsolicited.

Related

• RAG vs Fine-Tuning: Which Should a Business Use?
• Outlook “Message Has Been Changed” Error: How to Fix It
• Cybersecurity Facts and Stats: What the Numbers Mean