What are signs of a phishing email?

You've probably clicked on one before. Most people have. That's not failure: modern phishing emails are well-crafted and specifically designed to look like messages you'd normally act on. Knowing the warning signs doesn't make you immune, but it slows you down long enough to check.

Start with the sender address, not just the display name. "PayPal Customer Service" can be set to anything. The actual sending address is what matters. An email claiming to be from PayPal sent from paypa1-support.net is a phishing attempt. Hover over the "From" field or view the message headers to see the real address. Look for slight misspellings, extra characters, or unexpected domains.

Pressure tactics are a reliable red flag. "Your account will be suspended in 24 hours." "Unusual activity detected, act immediately." "You owe a balance that must be paid today." Legitimate services don't need to threaten you to get your attention. When urgency is manufactured, that's usually the point: to stop you from thinking clearly enough to check whether the email is real.

Requests for credentials or payment outside normal processes are almost always phishing. Your bank won't ask you to confirm your card number by replying to an email. Your IT department doesn't email you a login link out of nowhere and ask for your password. Legitimate services have authenticated portals. They don't need your credentials via email.

Check where the links actually go. Hovering over a link (without clicking) shows the destination URL in most email clients. If the email claims to be from Microsoft but the link goes to microsoft-account-verify.ru, that's your answer.

For organizations concerned about phishing targeting their staff or impersonating their brand, DMARC enforcement is the technical control that stops attackers from sending email that looks like it comes from your domain.