How to spot a phishing email: 10 checks, with an example

1. 1

   Ask the one question first

   "Do I have an account with this company, or know the person who contacted me?" The FTC says if the answer is no, it's likely phishing. Report it and delete it.

2. 2

   Look for a story with a problem

   The FTC says phishing messages "tell a story to trick you." Common ones: a login you didn't make, a payment problem, an invoice you don't recognize, a refund you're owed.

3. 3

   Check the sender's actual address

   Gmail says to check that the email address and the sender name match. "Netflix" sending from a random free email account is a giveaway.

4. 4

   Hover before you click

   On a computer, rest the mouse over a link without clicking. Gmail says if the web address doesn't match the link's description, it may lead to a phishing site.

5. 5

   Be wary of "update your payment" links

   The FTC says "legitimate companies won't email or text with a link to update your payment information." Go to the app or website yourself instead.

6. 6

   Notice the generic greeting

   "Dear Customer" or "Dear Member" instead of your name is one of the warning signs in the FTC's own example.

7. 7

   Watch for pressure and deadlines

   "Within 24 hours" or "your account will be closed" is designed to make you rush. Real companies give you time.

8. 8

   Don't open surprise attachments

   Apple lists an unsolicited message with an attachment as a sign of phishing. A "receipt.pdf" or "invoice.zip" you didn't expect should stay closed.

9. 9

   Never type a password or code from an email link

   Phishing often sends you to a fake sign-in page. Apple says it never asks for your password or two-factor code to provide support.

10. 10

    Take Gmail's warnings seriously

    If Gmail shows a warning like "This message could be a scam," believe it. Don't click links in that message.

An annotated phishing email

Here is an illustrative example, based on the streaming-service phishing email the FTC uses to teach these signs. The numbered notes show what to look for.

From: StreamFlix Billing <[email protected]>

Subject: Your account is on hold

"Dear Customer, we were unable to process your last payment, so your account is on hold. To keep watching, please update your payment details within 24 hours: [Update Payment]. Thank you, The StreamFlix Team"

• 1. The sender address is not the company's real domain. Always check the part after the @.
• 2. "Your account is on hold" is the story: a payment problem you didn't know about.
• 3. "Dear Customer" means they don't know your name.
• 4. "Within 24 hours" is pressure to act before you think.
• 5. The "Update Payment" button leads to a fake page that collects card details. The FTC says real companies don't email links to update payment information.
• What to do instead: Open the streaming app or type the company's address into the browser yourself. If there is a real problem, it will show there.

How to report phishing in Gmail

You can also forward phishing emails to the Anti-Phishing Working Group at [email protected], and report them to the FTC at ReportFraud.ftc.gov. Emails pretending to be Apple can go to [email protected], and PayPal fakes to [email protected].

1. Open the email

   On a computer, go to Gmail and open the message.

2. Open the More menu

   Next to Reply, click the three-dot More button.

3. Click Report phishing

   This reports the message to Google. Then delete it.

If you already clicked

Don't panic. What matters is what happened next. If you typed a password, change it from a different device. If you entered card or bank details, call the bank. If you shared your Social Security number, go to IdentityTheft.gov. If you downloaded something, the FTC says to update your security software and run a scan. Our page on what happens if you click a scam link walks through each case.

Questions people ask