To spot phishing emails, look at what the message wants you to do, check the full sender address, and verify important requests through a separate route. A familiar name, a logo, or polished grammar gives you little assurance on its own. If an email asks you to sign in, pay, download something, or share a code, pause before acting.
This guide is for everyday account holders and small-business owners handling receipts, delivery notices, and customer messages. The worked example follows an ebook-delivery email that arrives after a real purchase. You will see how to check the underlying request without opening an unexpected attachment or relying on the message’s own contact details.
Key Takeaways
- Inspect the requested action before reacting to the urgency.
- Check the full address behind the sender’s displayed name.
- Verify through an app, bookmark, or contact route you already trust.
- Report suspicious messages and choose recovery steps based on what you actually did.
What is the email asking you to do?
Read the message once for its requested action. Is it asking you to confirm an order, enter a password, open a document, or approve a new payment? A note about a purchase may be ordinary, but an unexpected request to supply a login code changes the situation. Identify that action before inspecting every sentence for spelling mistakes.
Pressure is a reason to pause and verify. A short deadline, a threatened account closure, or an unusually generous offer can make the next click feel urgent. The UK government’s phishing guidance describes these tactics and recommends breaking contact when a message appears fraudulent.
Think about the expected workflow. If you ordered a downloadable book, you expect a receipt and a way to access it. A demand for an unrelated software installation or a payment to release the download deserves a separate check. Write the request in plain words if the message is crowded with buttons and warnings.
How do you check the sender without trusting the display name?
Expand the sender details to see the address behind the friendly name. A display name can say Customer Support while the address belongs to a different domain. Compare the address with a source you already know, such as the company’s contact page reached independently. A slight spelling change can be easy to overlook on a phone.
An unfamiliar address is a clue to investigate. Companies may use payment processors or delivery services, so the difference alone may have an ordinary explanation. The useful next step is to confirm that relationship through the company’s own site or support channel. A reply to the suspicious email would keep you inside the same uncertain conversation.
The Canadian Centre for Cyber Security’s guidance on malicious email also cautions that a message can appear to come from someone you know. If a colleague suddenly asks you to buy vouchers or share a file, call them using an established number or use your usual internal channel. Confirm the specific request.
Which link and attachment clues matter?
Check the destination without following it
On a computer, hovering over a link may reveal its destination. Compare the actual address with the destination the button claims to open. A long address can hide the relevant domain among extra words. If the address is hard to interpret, use the service’s app or your own bookmark to check the account instead.
Treat unexpected files as a separate decision
Ask whether you expected that file, in that format, from that sender. A supposed receipt that asks you to run a program creates a different risk from a normal receipt viewed in your account. An attachment’s filename is a label chosen by its sender. Confirm the need for the file before opening it.
| Clue | What to check next |
|---|---|
| Button claims to open your account | Open the account independently and look for the same notice |
| Unexpected attachment | Confirm its purpose through a separate contact route |
| QR code supplied for an urgent login | Use the official app or known website instead |
| Request for a password or one-time code | Check the account directly and contact official support if needed |
Google’s phishing help explains sender checks, link inspection, and avoiding password entry after following a message link. A secure-looking page or a familiar logo can accompany a deceptive request. The independent account check gives you a way to investigate without depending on the email’s presentation.
How can you verify an ebook-delivery email safely?
Imagine you buy a book from the fictional Northfield Books store. Minutes later, an email titled Your download is waiting asks you to open an attachment and sign in again. The timing fits your purchase, so you are tempted to continue. Treat that timing as context and check the requested action separately.
Open the store using the address you used to buy the book, or return through an existing bookmark. Look at the order or download area if one is available. Suppose the book is ready there with no extra software required. Use that established route to retrieve it and leave the uncertain attachment unopened.
If the store offers no account area, use the contact details listed on its website to ask whether the email and attachment are part of delivery. Give the order reference through that established channel. You can describe the suspicious request without sending your password or forwarding private payment details.
In this example, support confirms that the store uses a download link and sends no attachment. That gives you a concrete basis for reporting the message. In a different case, support might confirm a legitimate delivery provider. The method works because you checked the workflow through an independent source.
What should you do with a suspicious message?
Use your email provider’s report-phishing function when available, then remove the message from your inbox. In Gmail on a computer, Google documents the Report phishing option in the message’s More menu. For a work account, follow your organization’s reporting process so the security team can examine the original message.
Avoid sending the email around as a warning to colleagues. Describe the issue through the approved reporting route. That lets the people responsible for the account decide what evidence they need and reduces the chance that another person opens the same attachment while trying to help.
If the message raises a real concern about an account, check that account separately after reporting. A phishing message can imitate an issue that also deserves attention, such as a delivery delay. For broader account protection, this guide to strong passphrases covers a different part of keeping your access secure.
What changes if you already clicked?
Start by recording what happened. Opening a link, entering a password, downloading a file, and approving a payment are different events. Close the suspicious page and avoid further interaction. If it involves a work account or device, tell the security team what you did and follow their instructions.
If you entered a password, go directly to the real service to change it and review its security and session controls. Change the same password on any other account where you reused it. If you supplied a one-time code, report that too, because someone may already have used it to sign in.
If you opened a downloaded file, contact your workplace support team or use the device vendor’s official security guidance for the next steps. For a payment, reach your bank or payment provider through an established route promptly. Keep the message and transaction details available for the reporting process they specify.
To continue learning, Computer Security is a related BestDigiBooks title. Use the specific action you took as the starting point for recovery. That gives support a clearer account than simply saying you clicked something suspicious.
Conclusion
With the next uncertain email, identify the requested action and open the relevant service independently. Confirm the request there or through an established contact route. Keep that pause as part of your routine, especially when a message arrives at exactly the moment you expect a receipt or delivery notice.
Frequently Asked Questions
Can a phishing email use my real name?
Yes. Personal details can make a message more convincing, and some may come from public information or earlier data exposure. Check the request and its source even when the greeting is accurate. Knowing your name does not establish that the sender is authorized to act for a company.
Should I reply to ask whether the message is genuine?
Use a separate contact route. A reply to the questionable message may reach the same person who sent it. Open the organization’s website independently or use a number already saved in your records, then ask about the exact request you received.
