Home / Academy / How to spot a phishing email

How to spot a phishing email

Updated 10 November 2026

Look at who really sent it, where the link really goes, and whether it rushes you. Most phishing emails fail on at least one of those. Here are the seven signs to check, and what to do if you already clicked.

We do this for you. You don't have to do anything.

  • Autopilot sends the request to every company we find, plus dozens of other data brokers that likely hold your data.
  • We send the reminders, handle the replies and keep track of the one-month deadline.
  • We rescan you every week. If your data comes back, we send a new request.
  • All you do is enter your name, confirm your email and give us permission. Free during the beta.

1. The sender address doesn't match

The name says "ING Security", but the address is service.ing-nl@gmail.com. Real companies send from their own domain. Tap or hover over the sender name to see the full address.

2. The link goes somewhere else

Hover over a link (or press and hold on a phone) before you click. A link to ing-verify-login.com or a shortened link is not your bank. Lookalike letters are a classic trick too, like rnicrosoft.com.

3. It rushes you

"Within 24 hours", "your account will be closed", "final notice". Urgency is there to stop you from thinking. A real company gives you time and lets you log in the normal way.

4. It asks for a code, password or payment

Banks and real services never ask for your password, login code or card details by email. A request for a small payment, like a parcel fee, is a common hook.

5. It doesn't use your name

"Dear customer" from a company that knows you is a warning sign. Careful: phishing that uses leaked data does know your name, so this sign alone doesn't prove an email is safe.

6. It knows a bit too much

AI tools now write flawless emails, and leaked or brokered data lets scammers mention your employer, your address or a recent order. Ask yourself how they got that, and check through a channel you already know.

7. It comes with an attachment you didn't expect

Invoices, voicemails and "documents to sign" as attachments or download links are a common way to install malware. Don't open them unless you expected them.

Already clicked?

  1. If you entered a password, change it now, and anywhere else you use it.
  2. If you entered bank details or paid, call your bank straight away.
  3. If you opened an attachment, scan your device and change saved passwords.
  4. Report it: in the UK forward the email to report@phishing.gov.uk; elsewhere, forward it to the real company's abuse address.

Get fewer phishing emails

Targeted phishing works because your email, employer and phone number are for sale. Not sure about a message? Paste it into our free scam check. Autopilot then asks data brokers to delete your details, so scammers have less to work with.

Questions

What should I do with a phishing email?

Don't click or reply. Report it (in the UK to report@phishing.gov.uk), then delete it.

Can I get hacked just by opening a phishing email?

Opening the email itself is rarely enough. The danger is in clicking links, opening attachments or entering details.

Why do I get so many phishing emails?

Your email address is probably in data breaches and on data broker lists. Removing it from brokers and checking breaches cuts the targeted ones.

More numbers on data brokers, breaches and scams: privacy statistics 2026.

Sources

Read next

All Academy articles