How to tell if an email is a phishing attempt
Draft. Not published yet.
Phishing is a message that tries to get you to click a harmful link, open an attachment, or hand over a password, a code, or payment details. It can arrive as email, a text, a social media message, or a phone call, and it often pretends to be a person or company you already know.
You don’t need to be certain before you slow down. CISA’s advice is straightforward: if a message looks suspicious, treat it as phishing. If you think it might be real, don’t use the links or phone numbers in the message. Contact the company or person another way.
This is a field guide, not a scare piece. Perfect spelling is no longer a reliable all-clear. CISA notes that with AI, some phishing mail now has clean grammar, so you have to look at the other signs.
Signs that should make you pause
Look for more than one of these. Any one of them is enough to stop and verify.
Urgency or emotion. The message says your account will be closed today, a payment failed, a package can’t be delivered, or your boss needs a gift card right now. CISA flags urgent or emotionally loaded language, especially threats of bad consequences if you don’t respond immediately.
A request for secrets. It asks you to send a password, a one-time code, a Social Security number, a credit card, or a copy of your ID. Real Microsoft, bank, and government sign-in pages don’t start with an unsolicited email asking you to “confirm” those details by return message.
A sender address that isn’t quite right. The display name may say “Microsoft,” “Chase,” or your CEO, while the actual address is something else. Expand or hover over the sender (don’t click) and read the full address. Look for extra letters, a different domain, or public addresses that only look similar, such as a typo in the company name.
A link that doesn’t match the text. Hover over the link and look at the lower edge of the window or the preview your mail app shows. You want the real destination, not the friendly words in the message. Untrusted shortened URLs are another CISA warning sign, because they hide the destination. Don’t click just to “check.”
An unexpected attachment. An invoice, voicemail file, or ZIP you weren’t waiting for is worth treating as unsafe, especially if the body of the message is thin.
It doesn’t sound like the person. A vendor, coworker, or family member who never writes that way, suddenly asking you to break a normal process (pay a new account, skip the usual approval, keep it quiet), deserves a second channel. Call or text them on a number you already have.
What to do instead of clicking
- Don’t click the link, open the attachment, or call a number from the message. Don’t use the “unsubscribe” link either. CISA’s guidance is to delete the message rather than interact with it.
- If you need to check whether a bill, a delivery, or a password reset is real, open a new browser tab and type the company’s address yourself, or use the official app you already installed. Sign in there and see whether the notice exists.
- If the message claims to be from a person, contact them another way: a phone number you already have, a Teams chat you start, or an in-person ask. Don’t reply in the same thread to “confirm.”
- Report the message, then delete it.
How to report it in Outlook
In current Outlook (including new Outlook, Outlook on the web, and recent Microsoft 365 Outlook), Microsoft provides a built-in Report action when your organization or account has user reporting turned on:
- Select the message. Don’t open attachments.
- Choose Report, then Report phishing. On some systems you may also see Report junk.
- If your company uses a Report Message or Report Phishing add-in instead, use that. Either way, you’re sending it to be reviewed rather than forwarding it to coworkers “to warn them” with the original links still live.
Your organization may move or delete the message after you report it. That’s expected.
If Report isn’t there, you can still delete the message and tell your IT person, or use your provider’s junk/phishing controls. In the United States, you can report scams at ReportFraud.ftc.gov.
If you already clicked
Close the page. Don’t type a password or a code. Don’t approve an Authenticator prompt you didn’t start. Then follow I clicked a phishing link. Now what?.
A quick habit that helps
When a message asks you to sign in, reset a password, pay an invoice, or share a code, take thirty seconds and leave the inbox. Type the site yourself, or call the number on the back of your card or on a past statement. Phishing works when it rushes that pause. You don’t need a special tool to take it.
Related: Getting MFA prompts you didn’t ask for?