How to Spot a Phishing Email in 2026: 8 Signs Before You Click

Phishing emails stole over $2.7 billion from Americans in 2023, according to the FBI. And they're getting harder to spot. AI-generated phishing emails now have perfect grammar, use your real name, and reference your actual accounts.

This guide covers the 8 most reliable ways to identify a phishing email — even the sophisticated ones — and what to do if you've already clicked.

What Is Phishing?

Phishing is when a scammer sends an email pretending to be a trusted organization — your bank, Amazon, the IRS, FedEx, your employer — to trick you into clicking a link, entering your password, or downloading malware.

The goal is almost always one of three things:

1. Steal your login credentials
2. Steal your financial information
3. Install malware on your device

Sign #1: The Sender's Email Address Doesn't Match

This is the most reliable check. Look at the full email address — not just the display name.

Scammers use addresses like:

• [email protected] (not @amazon.com)
• [email protected] (not @paypal.com)
• [email protected] (not @irs.gov)

The display name can say anything — "Amazon Security Team," "Your Bank," "IRS Refund Department" — but the actual sending address reveals the truth. Hover over or tap the sender name to see the full address.

Sign #2: The Link Doesn't Go Where It Says

Before clicking any link in an email, hover over it (on desktop) to see the actual URL in the bottom of your browser. On mobile, press and hold the link.

Red flags:

• The URL contains the brand name but isn't the official domain: amazon.account-verify.com vs amazon.com
• The URL uses a URL shortener: bit.ly/3xK9mP
• The URL has random characters: secure-login.amazon.com.xn--p1ai/signin

When in doubt, don't click the link. Go directly to the website by typing the address in your browser.

Sign #3: It Creates Urgency or Fear

"Your account will be suspended in 24 hours." "Unusual activity detected — verify immediately." "Your package could not be delivered — action required."

Urgency and fear are the primary tools of phishing. Legitimate companies don't threaten to close your account via email without prior notice. They don't demand immediate action.

When you feel pressured to act fast, slow down.

Sign #4: It Asks for Information a Legitimate Company Already Has

Your bank already has your account number. Amazon already has your address. The IRS already has your Social Security number.

If an email asks you to "confirm" or "verify" information the company should already have — especially financial information, passwords, or Social Security numbers — it's phishing.

Sign #5: The Greeting Is Generic

"Dear Customer." "Dear Account Holder." "Dear User."

Legitimate companies address you by name. Phishing emails are sent in bulk and often don't know your name. Generic greetings are a reliable red flag, though sophisticated phishing attacks do use your real name.

Sign #6: The Email Contains Unexpected Attachments

An email from "your bank" with a PDF attachment you didn't request. An "invoice" from a company you don't recognize. A "shipping label" from FedEx.

Malicious attachments are one of the primary ways ransomware and spyware are installed. Don't open attachments from unexpected emails, even if the sender looks legitimate.

Sign #7: The Offer Seems Too Good

"You've been selected for a $1,000 Amazon gift card." "Your tax refund of $3,247 is ready to claim." "You've won a free iPhone."

If you didn't enter a contest, you didn't win. If the IRS owes you a refund, they'll mail you a letter — not email you a link to claim it.

Sign #8: Something Just Feels Off

Trust your instincts. If an email feels slightly wrong — the logo looks a little different, the language is slightly awkward, the formatting is off — that feeling is worth investigating.

Forward suspicious emails to the real company's security team. Most major companies have a phishing report address: [email protected], [email protected], [email protected].

What to Do If You Already Clicked

If you entered a password: Change it immediately on the real website. If you use the same password elsewhere, change it there too. Enable two-factor authentication.

If you entered financial information: Contact your bank or credit card company immediately. Place a fraud alert with the credit bureaus.

If you downloaded an attachment: Run a full antivirus scan immediately. Consider contacting a cybersecurity professional if you're on a work computer.

Report it: Forward the email to the FTC at [email protected] and to the Anti-Phishing Working Group at [email protected].

How Warnvo Can Help

Warnvo's Scam Email Detector analyzes suspicious emails and:

• Checks sender domains against known phishing patterns
• Analyzes link URLs for redirect chains and suspicious domains
• Identifies urgency language and social engineering tactics
• Tells you whether the email is likely legitimate or a scam

Paste the email content at warnvo.com/scam [blocked] for a free analysis.

This article is for informational purposes only. If you believe you are a victim of fraud, contact the FTC at reportfraud.ftc.gov.