Learning how to spot a phishing email is one of the most useful skills you can pick up in 2026. Phishing emails are fake messages designed to look like they come from your bank, your employer, Amazon, PayPal, HMRC, the Canada Revenue Agency, Microsoft, Google, or another company you trust. Their goal is simple: get you to click a link, open an attachment, or hand over a password, a code, or your card details. In this guide, you will learn the 10 red flags that give a phishing email away, with practical examples you can check in under a minute.
Phishing is no longer just badly spelled messages from a stranger. In the United States, the United Kingdom, and Canada, criminals now use artificial intelligence to write polished emails, copy real company logos and layouts, and send messages that reference real orders, deliveries, and subscriptions. That is why simply looking for spelling mistakes is not enough anymore. The good news is that almost every phishing email still breaks at least one of the 10 rules in this article. Once you know what to look for, most of them are easy to spot.
Why phishing emails are so dangerous in 2026
A single click can lead to a stolen password, a drained bank account, or a locked computer. Phishing is the starting point for most online fraud in the US, UK, and Canada, and it works because it targets people, not computers. The email does not need to break through your security software. It only needs you to be busy, tired, or worried for a few seconds — for example, when a message claims your account will be closed, a parcel cannot be delivered, or you owe tax.
The 10 red flags of a phishing email
1. The sender’s email address does not match the company
The display name may say “PayPal” or “Royal Mail,” but always check the actual email address behind it. A real message from PayPal comes from an address ending in @paypal.com. A phishing email might come from support@paypal-security.net, paypal@customer-helpdesk.com, or a long jumble of letters at a free email service. The same applies in the UK and Canada: HMRC will not email you from a Gmail address, and the Canada Revenue Agency will not ask you to reply to a personal inbox. On a phone, tap the sender’s name to reveal the full address before you trust it.
2. Urgent language that pushes you to act now
“Your account will be suspended in 24 hours.” “Your parcel will be returned today.” “Unusual activity detected — verify now.” Phishing emails create panic so you click before you think. Real banks, delivery companies, and government agencies in the US, UK, and Canada rarely demand immediate action by email, and they do not threaten to close your account in a few hours. If a message makes your heart race, that is the moment to slow down. Open the company’s official app or type its web address into your browser yourself instead of using the link in the email.
3. A link that goes somewhere different from what it claims
Hover over a link on a computer — or press and hold it on a phone — to see where it really leads. A link that says “Sign in to Amazon” should go to amazon.com, amazon.co.uk, or amazon.ca. A phishing link might go to amazon-signin-secure.com, amzn-support.net, or a shortened link that hides the destination. Watch for small misspellings such as “micros0ft” with a zero, extra words such as “apple-support-login,” and odd endings such as .xyz or .top. Never log in through a link in an unexpected email. Go to the site yourself.
4. An unexpected attachment you were not expecting
Be very careful with attachments you did not ask for, especially files ending in .zip, .exe, .scr, or .iso, or a document that asks you to “enable macros” to view it. A common trick in 2026 is an email that looks like an invoice, a parcel label, or a scanned document, with a file attached. Even a PDF or a Word file can carry a link to a fake login page. If you were not expecting a file, do not open it. Contact the supposed sender through a number or address you already have, and ask whether they sent it.
5. A request for passwords, codes, or payment details
No genuine bank, government agency, or major online store will ask you to email them your password, a one-time code, your full card number, or your Social Security number, National Insurance number, or Social Insurance Number. In the US, the IRS does not start contact by email. In the UK, HMRC does not ask for bank details by email. In Canada, the Canada Revenue Agency does not ask for payment by gift card or cryptocurrency. If an email asks for sensitive details, it is almost certainly a phishing email.
6. Spelling, grammar, or formatting that feels off
AI has made phishing emails smoother, but many still contain small errors: a company name spelled two different ways, awkward sentences, a greeting such as “Dear Customer” when the company normally uses your name, or a logo that looks stretched or low quality. Compare the email with a real message from the same company if you have one. A genuine email usually has a proper postal address and an unsubscribe option that works. A phishing email often has a bare footer or broken links.
7. A generic greeting instead of your name
“Dear valued customer,” “Dear user,” or “Hello friend” can be a warning sign, especially from a bank, a streaming service, or an online shop that knows your name. It is not proof on its own — some genuine newsletters use a generic greeting — but combined with any other red flag on this list, it should make you stop.
If you are learning how to spot a phishing email, it also helps to keep your own devices in good shape. Slow phones and outdated apps make it harder to check links and update security settings, so read our guide on why your phone is so slow and how to fix it if your device is struggling.
8. A too-good-to-be-true offer or prize
“You have won a $1,000 gift card.” “Claim your free iPhone 17 Pro.” “You are eligible for a $2,000 tax refund — claim it now.” If you did not enter a competition, apply for a refund, or buy a ticket, you have not won anything. Prize and refund scams are common in the US, UK, and Canada, and they usually ask you to pay a small “delivery fee” or “processing fee” first, or to log in to claim the prize. That fee, or that login, is the scam. A genuine prize will not ask you to pay to receive it.
9. A strange reply-to address or a mismatched website
Check the “reply-to” address as well as the sender. A message that claims to come from your bank but replies to a free email address is a fake. Also look at the website the email sends you to. A real login page for a major company uses its normal web address and a secure connection, and it looks and works the way you expect. If in doubt, close the page and go to the company’s site or app yourself.
10. An email you were not expecting at all
Sometimes the simplest red flag is the context. Did you order a parcel? Did you request a password reset? Did you sign up for that subscription? If the answer is no, treat the email with suspicion, even if it looks perfect. Phishing emails often arrive out of the blue and claim to be about an account, an order, or a service you do use, hoping you will not stop to check. If you were not expecting the message, do not click, do not reply, and do not download anything. Verify it through the company’s official channel first.
What to do if you clicked a phishing link
Do not panic, but act quickly. If you clicked a link in a phishing email, you now know how to spot a phishing email — use that knowledge next time. Do not enter any passwords or payment details on the page that opened. If you did enter a password, change it right away from the real website or app, and change it anywhere else you used it. Turn on two-factor authentication on your email, banking, and social media accounts. If you entered card details, call your bank or card company using the number on the back of your card. In the US, report the message to the Federal Trade Commission. In the UK, forward it to report@phishing.gov.uk and report it to Action Fraud. In Canada, report it to the Canadian Anti-Fraud Centre. Finally, scan your device with security software and check your email settings for any new forwarding rules you did not create.
AI tools can help you work faster, but they can also be misused by scammers to write convincing fake emails, so it is worth knowing which tools are genuine. Our round-up of the best free AI tools for students in 2026 covers 10 tools that actually work, and the earlier best free AI tools for students in 2025 is a useful starting point if you are new to AI. The same care applies to any tool you install: only download apps and browser extensions from official stores, and check reviews before you install them.
Frequently asked questions about phishing emails
Can a phishing email infect my phone or computer just by opening it?
Opening an email is usually safe on its own. The danger comes from clicking a link, opening an attachment, or entering details on a fake page. That said, you should still avoid opening attachments from unknown senders, and keep your phone and computer updated, because updates fix security holes that attackers try to exploit.
How can I tell a real email from my bank apart from a phishing email?
Check the sender’s full address, hover over any links to see the real destination, and look for urgency or requests for passwords and codes. A real bank will never ask for your full password or a one-time code by email. When in doubt, log in through the bank’s official app or by typing its address yourself, or call the number on the back of your card.
What should I do with a phishing email?
Do not click, reply, or download anything. Mark it as spam or phishing in your email app, which helps your provider block similar messages. Then report it using the addresses above for the US, UK, or Canada, and delete it. If the message pretends to be from a company you use, you can also forward it to that company’s official phishing report address, which is usually listed on its website.
Conclusion: pause, check, then click
Knowing how to spot a phishing email comes down to one habit: pause before you click. Check the sender’s real address, hover over the link, ask whether you were expecting the message, and never send passwords, codes, or payment details by email. If a message breaks even one of the 10 red flags in this guide, treat it as a scam until you can verify it another way. Share this checklist with your family, especially with parents and grandparents who may be less familiar with online scams, and bookmark it so you can run through it the next time a suspicious email lands in your inbox. A few seconds of checking can save you hours of sorting out a stolen account — and a lot of money.