How to Spot a Phishing Email in 30 Seconds

Phishing emails try to make you act before you think. The good news is that a short, consistent routine catches almost all of them. Run through these five checks whenever a message asks you to click, pay or sign in.

1. Who really sent it?

Look past the display name to the actual address and its domain. "Your Bank <security@yourbank-alerts.example>" is not your bank. Watch for extra words, swapped letters and unusual endings.

2. Is it pushing urgency?

Threats of account closure, missed deliveries or unpaid invoices "within 24 hours" are designed to rush you. Real organisations rarely demand immediate action by email.

3. Where does the link go?

On a computer, hover over a link to preview the destination; on a phone, press and hold. If the domain does not match the organisation, do not open it. Safer still: type the website address yourself.

4. Does it ask for secrets?

Legitimate companies do not ask for your password, full card number or one-time codes by email. Any message that does is suspicious by definition.

5. Is the attachment expected?

Unexpected invoices, "scanned documents" and archive files are common malware carriers. If you were not expecting it, confirm with the sender through another channel.

Where temporary email helps

Using temporary addresses for one-off sign-ups keeps your main inbox off many marketing and leaked lists, which means fewer phishing attempts reach you in the first place. When a message does arrive at your real address claiming to be from a service you only ever registered with a temporary address, you know immediately that it is fake.