How to Spot a Phishing Email: 12 Red Flags
Phishing emails pretend to come from a company or person you trust in order to steal your password, money or personal data. They are getting more convincing every year. Learn these twelve red flags and you’ll catch the vast majority of them.
The 12 red flags
1. The sender address doesn’t match
The name says “PayPal” but the address is service@paypa1-secure.co. Always check the actual address, not just the display name.
2. Urgency or threats
“Your account will be closed in 24 hours!” Pressure is designed to stop you thinking.
3. A generic greeting
“Dear customer” from a company that normally uses your name is suspicious.
4. Links that go somewhere else
Hover over (or long-press) a link before clicking. If the real destination isn’t the company’s official domain, don’t click.
5. Requests for passwords or codes
Legitimate companies never ask you to email your password or read out a verification code.
6. Unexpected attachments
Invoices, “documents” or ZIP files you weren’t expecting can contain malware.
7. Spelling and design mistakes
Typos, odd grammar, blurry logos and strange formatting are classic signs — though modern phishing can look perfect, so don’t rely on this alone.
8. Too good to be true
Prizes, refunds and investment opportunities you never applied for are almost always scams.
9. Requests to pay in unusual ways
Gift cards, crypto or wire transfers to “fix” a problem are a major warning sign.
10. Mismatched reply-to address
If replying would go to a different address than the sender, be careful.
11. Login pages that look slightly off
Check the address bar before typing your password. A password manager that doesn’t auto-fill is a useful warning.
12. It arrived at an address you never gave that company
If you only used a temporary email for a shop, a “bank” email at that address is clearly fake. Using different addresses for different services makes phishing much easier to spot.
What to do if you clicked a phishing link
- Don’t enter anything else. Close the page.
- Change your password on the real website, and anywhere else you used it.
- Turn on two-factor authentication.
- Contact your bank immediately if you entered card details.
- Scan your device if you opened an attachment.
- Report it — in France via signal-spam.fr or cybermalveillance.gouv.fr, and to the company being impersonated.
Frequently asked questions
Can I get hacked just by opening an email?
Rarely. The danger usually comes from clicking links, opening attachments or entering information.
Does a temporary email protect me from phishing?
It reduces your exposure: scammers who collect a disposable address can’t reach your real inbox once it expires. Combine it with the checks above for the best protection.
