How to tell if an email is phishing before you click

Concerns & risks

You received an urgent email that might be a phishing attempt.

Causes & evidence

The FTC explains that scammers use email and text messages to trick you into giving them personal information such as passwords, account numbers or Social Security numbers. Phishing messages often tell a story to get you to click a link or open an attachment, such as saying there's suspicious activity, a problem with your account or payment information, or that you need to confirm personal details. They may look like they come from a company you know or trust, with a real-looking logo. The FTC advises that if you get an email you think may be a scam, don't click links; instead contact the company using a phone number or website you know is real. Using multi-factor authentication helps protect accounts even if a password is stolen.

Phishing messages are getting better at copying real brands, and some include your name or partial details. That's why the method matters more than how the message looks.

Clicking the link 'just to check' is how most phishing succeeds.

What to do

1. Don't click links or open attachments in the message.
2. Hover over links to see the real address, without clicking.
3. Go to the company's site or app directly, or call a number you know.
4. Report the message as phishing in your email app.
5. Forward phishing emails to reportphishing@apwg.org and report to the FTC.

Common mistakes:

• Trusting the logo
• Replying with information
• Calling a number listed in the email

ReportSpeedMan tip: Turn on multi-factor authentication for email and banking so a stolen password alone isn't enough.

What I would actually do

I'd never use a link in an urgent message; I'd open the bank's app myself and check for alerts there.

The trade-off people miss: phishing increasingly arrives by text and messaging apps too, so the same rule applies beyond email.

How to tell it worked

Suspicious messages are reported and you only log in through apps or saved sites.

Quick FAQ

Is it safe to open the email?
Opening is usually fine; clicking is the risk.

What if I clicked?
Change the password and enable MFA.

Where do I report it?
Your email provider and the FTC.

Wrap-up: Urgency plus a request for information equals a red flag. Go to the company directly instead of clicking.

Wiki: Phishing and Multi-Factor Authentication (MFA).

How to tell if an email is phishing before you click: where the facts come from

• FTC: How to recognize and avoid phishing scams
• CISA: Recognize and report phishing