How to Recognize a Phishing Email: 5 Signs That Never Lie
Learning objective
After reading this article, you will be able to identify the five most reliable signs of a phishing email, understand how ransomware reaches your device, and apply a simple verification method before replying to any suspicious message, starting today.
A situation you might recognize
You receive an email that appears to come from PayPal. The logo is correct. The formatting looks professional. The message tells you unusual activity has been detected on your account and that you must verify your details within 24 hours, or face suspension.
You feel a slight pressure. Maybe it's genuine. You don't want to lose access to your account. You hover over the link, and something about the address feels off.
That is exactly how phishing works: not through obvious mistakes, but through a carefully constructed sense of urgency that pushes you to act before you think.
What exactly are we talking about?
Phishing means sending fraudulent emails or messages that imitate a trusted organization (a bank, a delivery service, a tech company) in order to steal your personal information, passwords or banking details.
Ransomware is malicious software which, once installed on your device, encrypts your files and demands payment to give you back access. In most cases it arrives through a phishing email: either via an attachment you open, or a link you click.
The two are closely linked: phishing is often the delivery vehicle, and ransomware one of its possible consequences.
The 5 signs an email isn't what it claims to be
Sign 1 — The real address doesn't match the displayed identity
Scammers register domains that look almost identical to the legitimate ones. A single character is enough: paypall.com, amazom.com, yourbank-security.net.
What to do: don't trust the displayed name. Look at the actual email address. In most email clients, clicking or hovering on the sender's name reveals the full address. If it doesn't match the organization's known domain exactly, treat the email as suspicious. One caveat: a correct address alone doesn't prove legitimacy (the displayed sender can sometimes be spoofed), but an incorrect address condemns the message with certainty.
Sign 2 — The message creates artificial urgency
"Your account will be suspended within 24 hours." "Immediate action required." "Suspicious activity detected, reply now."
Urgency is the most reliable tool in a scammer's kit. It's designed to short-circuit your natural caution and make you act before you have time to verify.
What to do: when an email pushes you to act immediately, treat that pressure itself as the alarm signal. Legitimate organizations (banks, payment services, public administrations) do not demand instant replies by email. Close the email and go directly to the official website to check whether your account really has a problem.
Sign 3 — Links that lead somewhere other than what they display
An email can display the text www.paypal.com while the link behind it actually leads to payp4l-security.net. The visible text and the real destination are two completely independent things.
What to do: before clicking any link, hover over it with your mouse (without clicking): the real destination appears at the bottom of the window. On mobile, a long press on the link shows the address without opening it. If it doesn't match exactly what you expect, don't click: delete the email and type the site's address yourself.
Sign 4 — Attachments you weren't expecting
An unexpected attachment (a PDF, a Word document, a ZIP file) is one of the most common ransomware vectors. Opening it can silently install malicious software, even if the file appears to open normally.
What to do: never open an attachment from an email you weren't expecting, even if the sender seems to be someone you know. Their account may have been hacked. Confirm with the person through a separate channel (a call, a distinct message) before opening. And keep in mind the only real insurance against ransomware: regular backups of your important files, on a disconnected external drive or in a trusted cloud. A backed-up file cannot be held hostage.
Sign 5 — Requests for personal information by email
No bank, no payment service, no legitimate company will ask for your password, card number or full identity details by email. That is simply not how these organizations operate.
What to do: if an email asks for sensitive information, stop immediately. Don't reply. Contact the organization through a channel you already know (the number on the back of your card, the website address you type yourself), never through the contact details provided in the email itself.
The 2 classic traps
Trap 1 — Trusting the visual appearance
A professional logo, correct branding, polished layout: none of it proves anything. Anyone can copy an organization's exact visual identity in minutes.
What to focus on instead: the sender's real address and the links' real destination. Those are the hardest elements to fake: the layout, by contrast, copies effortlessly.
Trap 2 — Replying under pressure without verifying
The fear of losing access to an account, or missing a deadline, is precisely the emotion phishing exploits. Under that pressure, it's easy to reply without thinking.
What to do instead: adopt a personal rule: any email requesting sensitive information requires prior independent verification. Call a number you already have. Log in to the site directly. If the problem is real, it will still be there after you've checked.
What really matters
Most phishing attempts rest on two ingredients: a convincing appearance and a sense of urgency. Neutralize either one, and the attack loses most of its effectiveness.
The single most effective habit you can build fits in one sentence: never act on an unexpected email without independently verifying its legitimacy first, not through the email itself, but through a separate, trusted channel.
Everything else (checking addresses, hovering over links, keeping devices updated, backing up files) supports that one fundamental habit.
A simple method to put in place
Step 1 — Train your eye on addresses. For the next two weeks, get into the habit of revealing the full address of every sender in your inbox, even for emails you trust. Three seconds each time, and the reflex becomes automatic.
Step 2 — Hover before you click. Systematically, even with known senders. With practice, spotting a fraudulent link becomes instinctive.
Step 3 — Apply the 60-second rule. Every time an email creates urgency, give yourself 60 seconds before doing anything. Open a new tab, go directly to the organization's website, check whether the problem is real. In almost every case, it won't be.
What "good enough" looks like:
- Beginner: you check sender addresses, recognize urgent language as an alarm signal, and hover over links before clicking
- Intermediate: you never open unexpected attachments, you verify requests independently before replying, and your devices and backups are up to date
- Advanced — two-factor authentication is active on all your important accounts, you know where to report attempts (in the UK forward emails to report@phishing.gov.uk and texts to 7726; in the US ic3.gov or reportfraud.ftc.gov; in France cybermalveillance.gouv.fr; in Spain INCIBE's 017 helpline; in Bulgaria cybercrime.bg), and you can recognize spear phishing: targeted attacks built from your personal information
An honest note
Even experienced users receive phishing emails that are genuinely hard to identify. The most sophisticated attacks are designed by professionals who know exactly how to make them convincing.
The goal is not to become impossible to fool. The goal is to slow down, verify, and never hand over sensitive information under pressure. That single habit protects you from the vast majority of attempts.