Can I get infected just by opening a phishing email?

Opening a plain email in a modern, updated client is very unlikely to infect you on its own. The danger is in what you do next: clicking a link, opening an attachment, or enabling macros. Previewing a message is safe; interacting with its contents is where the risk starts.

The email passed SPF and DKIM. Does that mean it is genuine?

It means the message really was sent from the domain in the From address and was not altered in transit. It does not mean the domain belongs to the company it imitates. Attackers set up SPF and DKIM correctly on their lookalike domains. Authentication tells you who sent it, not whether you should trust them.

Why do phishing emails have obvious mistakes?

Partly because they are mass-produced cheaply, and partly, some researchers argue, by design: an obviously flawed message filters out careful readers early and leaves the attacker talking only to people who are likely to follow through. Either way, the absence of mistakes is not evidence that a message is safe.

Is it safe to unsubscribe from a suspicious email?

No. An unsubscribe link in a phishing email is just another link. At best it confirms your address is live; at worst it leads to the same malicious page. Report the message and delete it instead.

What is the difference between phishing, spear phishing and smishing?

Phishing is the general term for fraudulent messages that impersonate a trusted party. Spear phishing is targeted at a specific person or company and uses details about them to seem credible. Smishing is the same attack delivered by SMS, and vishing is delivered by phone call. The warning signs are the same across all of them.

How to Spot a Phishing Email: 12 Signs to Check Before You Click

Phishing is the oldest trick in email and still the most effective. A message arrives that looks like it came from your bank, a parcel courier, a software vendor or your own manager. It asks you to do one small thing: confirm a password, approve a payment, open an invoice, click to track a delivery. The page behind the link is a copy of the real one, and the moment you type your password into it, somebody else has it.

What makes phishing dangerous is not technical sophistication. Most phishing emails are crude. They work because they arrive when you are busy, they borrow the logo and tone of a company you trust, and they give you a reason to act now. The defence is equally unglamorous: a short habit of checking a few things before you click. This guide lists the twelve signs that matter, in the order you should check them, and then explains what to do if you already clicked.

Start with the sender, not the message

The body of a phishing email is designed to be convincing. The envelope around it is much harder to fake. Check these first.

1. The real address behind the display name

Email clients show a friendly name such as "PayPal" or "IT Support" and hide the actual address. Tap or hover on the name to reveal it. A legitimate message from a company comes from a domain that company owns, such as @paypal.com. Phishing comes from a lookalike (paypa1.com, paypal-secure.net), a free webmail account, or a random domain that has nothing to do with the brand. If the address and the brand do not match, stop reading and delete.

2. A domain that is almost right

Attackers register domains that differ from the real one by a character or two, or that put the real brand in a subdomain: microsoft.com.login-verify.net is not Microsoft. The part that matters in any domain is the last two labels before the first slash. Everything to the left of that can be chosen freely by whoever owns the domain.

3. "Reply-To" pointing somewhere else

Some phishing emails are sent through a legitimate but compromised account, so the From address looks fine. The giveaway is a Reply-To header that routes your answer to a different mailbox. Most clients show it when you press reply. If you want to see every header at once, paste the raw message into an email header analyzer; it also tells you whether the message passed SPF, DKIM and DMARC, the three checks mail servers use to verify a sender.

Then read the message the way a sceptic would

4. Urgency and threats

"Your account will be suspended in 24 hours." "Unusual sign-in detected, verify now." "Final notice." Real companies rarely threaten you by email, and when they do restrict an account, they tell you to log in through their normal website or app, not through a link in the message. Urgency is there to stop you thinking. Treat it as a signal to slow down.

5. A request for credentials or payment details

No bank, tax office, or reputable service will ask you to confirm your password, PIN, card number or full identity document by email. If a message asks for any of these, it is phishing, regardless of how it looks.

6. Generic greetings and mismatched details

"Dear Customer" from a company that knows your name, an invoice for a product you never bought, a delivery notice when you are not expecting a parcel, a Netflix email sent to the address you only use for work. Attackers send in bulk and do not know who you are; genuine senders usually do.

7. Spelling, grammar and odd formatting

This sign is weaker than it used to be, because generative tools make fluent text cheap. Still, broken formatting, inconsistent fonts, a logo that is slightly blurry, or a footer that mentions a different company all point to a template that was copied rather than sent by the brand.

8. Links that do not go where they say

Hover over every link before clicking and read the destination in the status bar; on a phone, press and hold to preview it. A button that says "View your statement" should lead to the bank's own domain. If the destination is a URL shortener, an IP address, a free hosting platform, or a domain you do not recognise, do not click. When in doubt, open a new tab and type the company's address yourself.

9. Unexpected attachments

Invoices, voicemails, shipping labels and shared documents are the usual disguises. An attachment you were not expecting, especially a ZIP, an HTML file, a document that asks you to "enable content", or anything with two extensions like invoice.pdf.exe, should be treated as hostile. Modern attacks also use ordinary PDFs that contain a single link, so the attachment check is about expectation, not file type.

10. A login page that appears out of nowhere

You clicked, and a familiar login page appeared. Before typing anything, look at the address bar. A padlock only means the connection is encrypted; it says nothing about who owns the site. The domain must be exactly the one you expect. Phishing kits now clone pages pixel for pixel and even relay your one-time code to the real site in the background, so the URL is the only reliable tell.

11. Pressure to keep it secret or to bypass process

Business email compromise targets employees with messages that appear to come from an executive: "I am in a meeting, buy gift cards and send me the codes", "pay this supplier today, do not mention it to finance". Any request to move money or data outside the normal process, delivered by email alone, should be confirmed by phone using a number you already have.

12. It arrived at an address you never gave that company

If your "bank" writes to an address you only used for a forum signup, the message cannot be genuine. This is one of the quiet advantages of using different addresses for different purposes: a message sent to the wrong one exposes itself. People who use disposable addresses for throwaway signups get this benefit automatically, because those inboxes expire and anything sent to them later is simply never seen.

What to do if you already clicked

If you typed a password, change it now on the real site, and change it anywhere else you reused it. Reused passwords are the reason one phished login turns into ten compromised accounts.
Turn on two-factor authentication for that account if it was not already on. Our guide to two-factor authentication explains which kind to choose.
If you entered card or bank details, call the number on the back of the card and say the details were phished. Banks deal with this daily and can block the card and watch for transactions.
If you opened an attachment or "enabled content", disconnect from the network, run a full antivirus scan, and if it is a work device, tell your IT team immediately. Do not feel embarrassed; speed matters far more than blame.
Check for changes the attacker may have made: new forwarding rules in your mailbox, a changed recovery email or phone number, new devices in the account's security settings. Forwarding rules are a favourite because they keep working after you change the password.

How to report a phishing email

Reporting is worth doing because it gets the phishing site taken down faster and trains your provider's filters. In Gmail, open the message menu and choose "Report phishing". In Outlook, use the "Report" button in the ribbon. Many countries have a national reporting address as well; the UK's is report@phishing.gov.uk, and in the United States you can forward messages to reportphishing@apwg.org. If the email impersonates a specific company, that company usually publishes an abuse address such as phishing@ or abuse@ their domain.

Habits that make phishing fail

Never log in from a link in an email. Go to the site yourself. This single rule defeats almost every credential phish.
Use a password manager. It will refuse to fill your password on a lookalike domain, which is an automatic phishing check you do not have to think about.
Separate your addresses. One for finance and anything that matters, one for shopping and newsletters, and temporary addresses for one-off signups. A phish sent to the wrong one gives itself away.
Assume attachments are hostile until proven otherwise, and confirm unexpected ones by a second channel.
Keep software updated. Many attachment-based attacks rely on vulnerabilities that were patched months earlier.

None of this requires technical skill. It requires a pause of a few seconds and a willingness to be slightly rude to an email that is trying to rush you. That pause is the whole defence.