• Home
• Online Safety
• Phishing Awareness

How to Recognize Phishing Emails and Suspicious Messages

What is Phishing?

Phishing is when someone sends you a message—usually email, text, or chat—pretending to be from a legitimate organization to trick you into revealing personal information or clicking a malicious link. The goal is often to steal your login credentials, financial information, or identity information.

The term "phishing" comes from the idea of "fishing" for information. Scammers cast out many messages hoping someone will "bite" and fall for the trick.

Phishing is one of the most common types of online attacks. It's effective because it exploits human psychology rather than requiring advanced technical skills. Anyone can receive phishing messages, and even careful people occasionally fall for them.

Common Phishing Techniques

Scammers use various tactics to make phishing emails seem legitimate:

• Impersonation: Pretending to be from a company you use, like a bank, email provider, or online store.
• Urgency: Creating a false sense of urgency ("Your account will be closed!" "Confirm now or lose access!").
• Authority: Claiming to be from a high-level employee or official to make the message seem important.
• Generic greetings: Using "Dear Customer" or "Dear User" instead of your actual name (though some phishing emails do personalize).
• Threats or fear: Warning of account compromise, suspicious activity, or security breaches that don't exist.
• Rewards or offers: Promising prizes, refunds, or special offers to entice you to click.

Suspicious Links: Before You Click

Many phishing emails contain links that look legitimate but lead to fake websites designed to steal your information. Before clicking any link:

Hover over the link (without clicking) to see the actual URL it points to. Most email clients and webmail services show the real URL when you hover your mouse over a link.

Ask yourself: Does the actual URL match what you'd expect? If an email claims to be from your bank but the link goes to a different website, it's phishing.

Look for red flags in URLs:

• Slight misspellings of real company names (e.g., "amaznn.com" instead of "amazon.com")
• Suspicious domains you don't recognize
• The real company's name tacked onto a different domain (e.g., "bank-login-secure.suspicious-site.com")
• Unusual characters or encoding in the URL

When in doubt, don't click the link. Instead, go directly to the company's website by typing the address into your browser or using a bookmark you've saved previously.

Unexpected Attachments and Downloads

Phishing emails sometimes contain attachments that contain malware or spyware. Be cautious about:

• Unexpected attachments, especially .exe, .zip, or script files
• Attachments that seem to come from people you don't know
• Requests to enable macros in a document (a common malware delivery method)

If you receive an unexpected attachment, delete it or contact the sender through a different method (like calling them) to confirm they actually sent it.

Urgent Messages and Artificial Pressure

Phishing emails often create artificial urgency to make you act without thinking:

• "Your account will be closed in 24 hours"
• "Verify your information immediately"
• "Confirm your password now or lose access"
• "Click here to prevent fraud on your account"

Real companies rarely use high-pressure tactics in emails. They usually allow you time to resolve issues. If you receive an urgent message, take a moment to verify it's legitimate before responding.

Sender Address and Domain Checks

Check the sender's email address carefully:

• Look at the full email address: Sometimes the "From" name looks legitimate, but the actual email address is suspicious. The email address is the more reliable indicator.
• Watch for spoofing: Scammers sometimes slightly change email addresses to look like they're from a company. For example, "support-paypal@suspicious-site.com" looks official but isn't actually from PayPal.
• Check for generic domains: Companies typically use their own domain name in employee email addresses. "support@company.com" is legitimate. "support@gmail.com" claiming to be from that company is not.

Fake Login Pages

A common phishing tactic is sending you to a fake website that looks like a real login page. Once you enter your username and password, scammers capture that information.

To protect yourself:

• Verify the website address: Check that you're on the correct website before entering login credentials. Look at the address bar, not just the page itself.
• Use HTTPS: Look for a padlock icon and "https://" in the address bar. This indicates the connection is encrypted. However, fake sites can also use HTTPS, so it's not a complete guarantee.
• Never log in from a link in an email: If you receive an email asking you to log in, go to the website directly instead of clicking the link.
• Legitimate companies won't ask for passwords via email: Companies you do business with should never ask you to send passwords or other sensitive information via email.

Website Address Checks

When you land on a website after clicking a link, verify you're on a legitimate site:

1. Check the address bar carefully: Scammers sometimes register domains that look similar to real ones.
2. Look for security indicators: Legitimate websites typically have a padlock icon in the address bar. Click it to see certificate information.
3. Check for strange language or poor grammar: Many phishing sites are created quickly and may contain obvious spelling errors or awkward phrasing.
4. Be wary of unusual design: If a major company's website looks significantly different than usual, something might be wrong.

What to Do After Accidentally Clicking

If you accidentally click a suspicious link, don't panic. Here's what to do:

1. Stop immediately: Don't enter any information if you notice something is wrong.
2. Close the window: Close the browser tab or window.
3. Check your accounts: Log into your actual accounts (by going directly to the website, not through links) and check for suspicious activity.
4. Change your passwords: If you entered any credentials, change those passwords immediately.
5. Monitor for fraud: Watch your accounts and credit reports for unusual activity over the next weeks and months.
6. Consider fraud alerts: You can place a fraud alert with credit bureaus if you're concerned about identity theft.

Reporting Suspicious Messages

If you receive phishing messages, you can report them:

• To the company being impersonated: Most companies have a way to report phishing emails. Look for a "Report phishing" option or forward the email to their security team.
• To your email provider: Gmail, Outlook, Yahoo, and other email services allow you to report phishing emails. They use this information to improve their filters.
• To authorities: In severe cases or if you've been victimized, you can report phishing to the FBI's Internet Crime Complaint Center (IC3) or your local law enforcement.

Frequently Asked Questions

Related Articles