How to Spot Phishing Emails

Phishing email messages, websites, and phone calls are designed to steal money. Cybercriminals do this by installing malicious software on your computer or stealing personal information from your computer.

These malicious phishing emails are sent out daily, and although many are easy to spot, some might be a bit more convincing. So how do you tell the difference between a phishing message and a legitimate message? Keep these tips in mind as you check your email.

Always be suspicious.

Phishing emails try to freak you out with warnings of stolen information (or worse), and then offer an easy fix if you just “click here.” (The flipside: “You’ve won a prize! Click here to claim it!”) When in doubt, don’t click. Instead, open your browser, go the the company’s website, then sign in normally to see if there are any signs of strange activity. If you’re concerned, change your password.

Check for bad spelling and grammar.

This is an obvious red flag that the message could be malicious.

The message contains a mismatched URL

When an email looks suspicious, check the integrity of any embedded URLs. Oftentimes the URL in a phishing message will appear to be perfectly valid. However, if you hover your mouse over the top of the URL, you should see the actual hyperlinked address. If the hyperlinked address is different from the address that is displayed, the message is probably fraudulent or malicious.

URLs contain a misleading domain name

Similar to the previous tip, check the last part of a domain name. For example, the domain name would be a “child domain” of because appears at the end of the full domain name (on the right-hand side). Conversely, would clearly not have originated from because the reference to is on the left side of the domain name. Ex: or


The message requests personal information

No matter how official an email message might look, requesting money or personal information is a red flag. A reputable company will never send an email asking for your password, cash, credit card number, or the answer to a security question. Your bank or the government would never contact you by email for confidential personal information.

You didn’t initiate the action

If you get a message informing you that you have won a contest you did not enter, you the message is likely a scam.

The message makes unrealistic threats

Most phishing emails ask for cash or sensitive information by promising money or prizes. But some phishing emails use intimidation to scare victims into giving up information. If a message makes unrealistic threats, it’s probably a scam. Watch out for urgency as well. If the email threatens that unless you act immediately your account may be closed, it’s likely a scam.

Use common sense.

If it sounds too good to be true, it is. You can’t win a contest you didn’t enter. Your bank won’t contact you using an email address you never registered. Microsoft did not “remotely detect a virus on your PC.” Know the warning signs, think before you click, and never give out your password or financial details unless you’re properly signed into your account.

Something just doesn’t look right

If something looks off, there’s probably a good reason why. This same principle almost always applies to email messages. If you receive a message that seems suspicious, it’s usually in your best interest to avoid acting on the message.