How to spot a phishing email

Phishing attacks—internet scams where cybercriminals try to trick you into giving away sensitive information like credit card numbers or passwords—are becoming more prevalent. These schemes used to be easy to spot, but modern phishing threats are now highly sophisticated. It’s essential to know how to spot a phishing email, especially if you work from home. Working remotely without on-site IT support to help with cybersecurity can make you more vulnerable to scammers. Here’s what you need to know to avoid falling hook, line, and sinker for a phishing attack.

What are the common signs of a phishing email?

Recognizing the typical warning signs of a phishing email may not be enough to detect the most sophisticated modern scams, but it’s still essential to be on the lookout for:

• Poorly written messages with typos, misspelled words, or language that sounds unnatural
• Urgent language
• Requests for personal information
• Email addresses that don’t match the company’s name

You’re unlikely to see these easy-to-spot signs of a phishing email in your inbox. Because they’re easily detectable, email services can often filter and send them automatically to your spam folder. As a result, scammers have had to get more creative.

How to detect more advanced phishing tactics

Savvier scammers and more sophisticated AI technology make it tougher to differentiate between legitimate emails and phishing emails. Unlike phishing emails of the past, current scams are more likely to include clean, polished text and carefully crafted messages. Modern phishing threats often appear to come from the organization they’re imitating. Scammers typically employ elaborate phishing tactics to bypass email filters and other automated forms of protection.

Many harder-to-detect phishing threats use techniques that share a common theme. Scammers trick email filters and readers by embedding harmful links into email bodies in ways that visually appear to come from trusted sources. For instance, they may use Google Translate to generate a Google-hosted URL and then redirect that URL to an unsafe website. They may also use images of text rather than written messages to link directly to a bogus site or phone number. This tactic works because images are more complex for email services to automatically scan for warning signs of a phishing email.

By leveling up your skills, you can learn to detect more sophisticated types of phishing attacks and how to protect yourself from these internet scams. Add these strategies to your phishing tackle box:

• Use critical thinking as you read. If you get an unexpected message regarding an online order, bank account, or other potentially sensitive information, read the information carefully and check it against your records. Being contacted about an item you didn’t purchase or an account activity you don’t recall could indicate it’s a phishing email.
• Check for disguised images. If a message seems “phishy,” try selecting the text. If you discover the text is actually an image—the message looks like an email but is a screenshot—there’s a good chance it’s fraudulent.
• Verify the source. If you suspect the message might be a phishing attempt, don’t interact with it until you can check with the organization independently. For example, if you get a suspicious request that appears to be from your bank, don’t click any links or call any numbers provided in the message. Instead, go to your bank’s website and call the customer service number directly to discuss the matter.
• Pay close attention after the @. Carefully study the sender’s email address when you get a suspicious message. Scammers can easily customize the name that appears in the “from” line (such as “Amazon Customer Service”). However, if the end of the email address doesn’t end with a legitimate URL (like “@amazon.com”), there’s a good chance it’s a scam.
• Know your contacts. Even if the email comes from a trusted source, such as a friend or coworker, beware if something doesn’t feel right or shows signs of a potential phishing threat. If your contact has fallen victim to a phishing scam, the cybercriminal could use their email address to target new victims. If you suspect the request isn’t from your contact, speak to them directly by phone or in person to determine its validity.

Learn more about how to prevent phishing and what to do if you’ve fallen for a phishing email.