How to Spot & Report Phishing Emails Before Clicking

Phishing emails are one of the most common ways attackers steal passwords, financial data, or install malware. This guide shows you how to examine an email for red flags, what to do if you suspect it’s a scam, and how to report it to your organization or email provider—all before you click any links or attachments.

What You’ll Need

• The suspicious email (keep it in your inbox—don’t delete it yet)
• Access to your email client (webmail, Outlook, Gmail, etc.)
• A way to report: usually a “Report phishing” button or a forwarding address (e.g., reportphishing@apwg.org)
• Optional: a second device to check the sender’s domain or look up known scam patterns

Step-by-Step

1. Check the sender’s email address, not just the display name. Attackers often set the display name to “PayPal” or “IT Support” but the actual address will be something like “paypal@secure-login.net” or “support@it-helpdesk123.com”. Hover over or click the sender name to reveal the full address. If the domain doesn’t match the company’s official domain (e.g., paypal.com, microsoft.com), treat it as suspicious.
2. Look for generic greetings. Legitimate companies usually address you by name. “Dear Customer” or “Dear User” is a red flag, especially if the email claims to be about your account.
3. Read the subject line and body for urgency or fear tactics. Phrases like “Your account will be closed”, “Immediate action required”, or “You’ve won a prize” are classic phishing triggers. Scammers want you to act without thinking.
4. Hover over every link before clicking. On a computer, hover your mouse over the link (without clicking) and look at the URL in the status bar or bottom corner. If the URL looks odd—misspelled domains, extra numbers, or a completely different site—do not click. On mobile, press and hold the link to see the destination.
5. Check for spelling and grammar errors. Phishing emails often contain awkward phrasing, missing words, or odd punctuation. While some are well-crafted, many still have obvious mistakes.
6. Look at the attachments. If the email asks you to open a file, especially a .zip, .docm, .exe, or .scr, be very cautious. Even if the sender looks familiar, call them to verify before opening.
7. Verify the request through another channel. If the email claims to be from your bank, your IT department, or a service you use, contact that organization directly using a phone number or website you know is legitimate. Do not use any contact info from the suspicious email.
8. Don’t reply to the email. Replying confirms your address is active and may lead to more targeted attacks.
9. Report the email. Use your email provider’s built-in “Report phishing” option (Gmail, Outlook, Yahoo, etc.) or forward the email to your organization’s security team. If you’re not sure where to report, forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.
10. Delete the email. After reporting, delete it from your inbox and trash folder to avoid accidental clicks later.

Common Mistakes

• Trusting the display name. The name shown is not proof of the sender. Always check the actual email address.
• Clicking a link “just to see”. Even a single click can trigger a download or redirect you to a fake login page. If you’re curious, don’t click—use the hover method.
• Opening attachments on a work device. A malicious attachment can infect your whole network. If you’re unsure, forward it to IT first.
• Ignoring the “https” in a link. A padlock doesn’t mean the site is legitimate; phishing sites can use HTTPS too. Check the domain name itself.
• Assuming all phishing emails are poorly written. Some are very convincing, so always verify independently.

Tips

• Enable two-factor authentication (2FA) on important accounts. Even if your password is stolen, 2FA can block the attacker.
• Keep your email client and antivirus software up to date—they often include phishing filters.
• If you’re at work, report the email to your IT/security team immediately. They can warn others and block the sender.
• Use a password manager—it won’t autofill on a fake website, which is a built-in phishing detector.
• When in doubt, delete. It’s better to miss a legitimate email than to fall for a scam.

Troubleshooting

You already clicked a link or opened an attachment. Don’t panic. Disconnect from the internet (turn off Wi-Fi or unplug the network cable) to limit any malware spread. Then run a full antivirus scan. Change your passwords from a different, known-secure device. If you entered any personal or financial information, contact the relevant institution (bank, credit card company) immediately. Finally, report the incident to your IT department or the service provider.

You can’t find the “Report phishing” button. In Gmail, it’s under the three-dot menu next to the reply arrow. In Outlook, it may be under the “Home” tab or the “Report” button. If you can’t locate it, forward the email as an attachment (not just forwarded text) to your security team or the APWG.

The email looks legitimate but you’re still unsure. Contact the company directly using a phone number from their official website or a previous statement. Do not use the contact info in the email.

Frequently Asked Questions

What if I already clicked the link but didn’t enter any info?

You’re at lower risk, but still run a scan and change your passwords. Some links trigger downloads without any action on your part.

Can I just ignore phishing emails?

Ignoring them is not enough—they can still be used to target you again. Report and delete them.

Does reporting actually do anything?

Yes. Email providers and security teams use these reports to block the sender and warn others. It also helps improve spam filters.

What if the phishing email is from a friend’s hacked account?

Don’t reply to the email. Contact your friend through another method (phone, text) and let them know their account may be compromised.

Are all emails with links dangerous?

No, but treat any unsolicited email with links as suspicious. Verify the destination by hovering first.

How do I report phishing to the government?

In the US, you can report to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. Many other countries have similar reporting centers.

Related

• Tesla Phone: What It Is and Why It Doesn’t Exist
• Hide IP Address on Samsung Smart TV: Full Guide
• Hash Index vs B-Tree: How to Choose