A suspicious email does not always look badly written or obviously fake. Modern phishing messages can copy a real company’s branding, imitate a colleague, include personal information and create a convincing sense of urgency. The safest habit is simple: when a message asks you to click, open an attachment, sign in, send money or provide sensitive information, verify it before acting.
This checklist is designed for ordinary users, families and small organisations. You do not need specialist security tools to perform the first checks.
Stop before clicking
Phishing often relies on speed. The message may say your account will be closed, a payment failed, a parcel is waiting, your boss needs an urgent transfer, or you must confirm a password immediately. Urgency is a reason to slow down, not speed up.
Do not reply, click a link, open an attachment or use an unsubscribe link in a message you already suspect is malicious.
Check the real sender address
The display name can say almost anything. Expand the sender information and inspect the actual email address. A message claiming to come from a bank or Microsoft but using an unrelated free-mail address or a misspelled domain is a strong warning sign.
Be careful with small differences: an attacker may replace one character, add an extra word or use a subdomain designed to look familiar. Also remember that a correct-looking address is not absolute proof that a message is genuine.
Look at what the message is asking you to do
- Does it ask for a password, authentication code or banking information?
- Does it ask you to move a conversation away from the normal company process?
- Is somebody requesting an unusual payment, gift card or bank-account change?
- Does it threaten immediate loss of access if you do not act?
- Is the request unusual for the supposed sender?
A legitimate organisation may sometimes send urgent messages, so urgency alone does not prove phishing. It means you should verify independently.
Inspect links without opening them
On a desktop computer, hovering the pointer over a link usually reveals the real destination. Compare that destination with the organisation’s genuine domain. Be cautious with shortened URLs, unrelated domains and addresses that imitate a trusted brand.
If the email says there is a problem with your Microsoft account, bank, delivery service or online shop, do not use the link in the email. Open a new browser tab and navigate to the organisation’s official website yourself, or use its official app.
Treat unexpected attachments carefully
An unexpected attachment can be dangerous even when the filename looks normal. Documents, archives, executables and other file types can be used to deliver malware or lead you into a fake sign-in process.
If an attachment appears to come from somebody you know but you were not expecting it, contact that person using another method and confirm that they actually sent it.
Verify through a separate channel
This is one of the strongest simple checks. Do not reply to the suspicious message and ask whether it is genuine, because an attacker who controls the email account may simply reply again.
- Call the person using a phone number you already know.
- Open the organisation’s official website manually and use the contact details published there.
- Use the official banking, Microsoft 365 or other service app directly.
- For workplace requests, confirm through your normal internal communication channel.
Use the reporting tools in your email service
Outlook and many other mail systems provide a Report phishing or Report spam action. Reporting helps the mail provider or your organisation’s security team investigate and block similar messages.
After reporting, delete the message unless your IT/security team asks you to preserve it for investigation.
What if you already clicked?
The correct response depends on what happened next.
- You only opened the webpage: close it. Do not enter information. If a file downloaded automatically, do not run it.
- You entered a password: change that password immediately from the legitimate service, sign out other sessions if available and enable multifactor authentication. If the password was reused elsewhere, change those accounts too.
- You entered banking or card details: contact your bank/card provider using an official number as soon as possible.
- You opened or ran a suspicious attachment: stop using the device for sensitive work and contact your IT/security support. A malware scan and further investigation may be required.
- It was a work account: report the incident promptly to your organisation. Early reporting can limit damage.
A 30-second phishing check
- Do I recognize the real sender address?
- Was I expecting this message?
- Is it creating unusual urgency or fear?
- Is it asking for passwords, money or personal information?
- Does the real link destination match the organisation?
- Is there an unexpected attachment?
- Can I verify the request independently?
Quick Checklist
Before clicking a link, opening an attachment or replying to a suspicious email, check the following:
- ✅ Look carefully at the sender’s full email address, not only the display name.
- ✅ Check for small spelling changes in the sender’s domain name.
- ✅ Be cautious if the message creates urgency, fear or pressure.
- ✅ Do not trust a message only because it uses a familiar company logo.
- ✅ Hover over links before clicking to inspect the real destination.
- ✅ Avoid opening unexpected attachments, especially executable files or unusual archive files.
- ✅ Be suspicious of requests for passwords, verification codes, banking details or personal information.
- ✅ Verify unusual payment or account requests using a separate trusted contact method.
- ✅ Do not reply directly to the suspicious message when trying to verify it.
- ✅ If the message claims there is a problem with an online account, open the organisation’s official website or app yourself instead of using the email link.
- ✅ Check spelling, grammar and wording, but remember that well-written phishing emails also exist.
- ✅ Report suspicious emails through your organisation’s security process or your email provider’s phishing-report feature.
- ✅ Delete the message only after you have reported or preserved it if your organisation requires investigation.
A suspicious email does not always contain an obvious mistake. Modern phishing messages can look professional, use real company branding and even include information about you. The safest approach is to verify before clicking.
Frequently Asked Questions
What is a phishing email?
A phishing email is a fraudulent message designed to trick you into revealing information, opening malicious content, making a payment or visiting a fake website.
Attackers often pretend to be banks, delivery companies, Microsoft, Google, government services, colleagues, managers or other trusted organisations.
How can I tell whether an email address is fake?
Look at the complete sender address carefully.
Attackers may use domains that look similar to legitimate ones by changing, adding or removing a character. For example, a fake domain may look almost identical at first glance.
Do not rely only on the sender name shown in your inbox.
Is it safe to click a link if the email looks professional?
Not necessarily.
Modern phishing emails may use professional layouts, correct logos and good grammar. Before clicking, inspect the link destination and, when possible, visit the official website directly using your browser or a saved bookmark.
What should I do if an email says my account will be closed immediately?
Treat urgent threats carefully.
Instead of clicking the email link, open the official website or application yourself and check your account there. If the warning is genuine, you should normally be able to see the same problem after signing in through the legitimate service.
Can I trust an attachment from someone I know?
Not automatically.
A legitimate contact’s account may have been compromised, or the sender address may have been spoofed. If an attachment is unexpected, confirm with the sender through another trusted communication method before opening it.
What types of attachments should make me especially cautious?
Be particularly careful with unexpected executable files, scripts, macro-enabled documents, disk-image files and compressed archives.
Even familiar file formats can be dangerous if they contain malicious content, so the context of the message is just as important as the file extension.
What should I do if an email asks for my password or verification code?
Do not provide it.
Legitimate organisations generally should not ask you to send passwords, one-time authentication codes or recovery codes by email.
If you are unsure, contact the organisation using information from its official website rather than contact details provided in the suspicious message.
What if the suspicious email comes from my manager or colleague?
Verify the request independently, especially if it involves money, gift cards, passwords, confidential information or an unusual change of payment details.
Business email compromise attacks often impersonate senior employees or trusted business contacts.
What should I do if I already clicked a suspicious link?
Close the page and do not enter any information.
If you entered a password, change it immediately using the legitimate service and review the account’s security settings. If the same password is used elsewhere, change it there too.
If the device downloaded or executed something suspicious, disconnecting it from the network and contacting IT or security support may also be necessary.
What should I do if I entered my password on a fake website?
Change the password immediately through the real website or application.
Also:
- sign out of other active sessions where possible;
- enable multi-factor authentication if it is not already enabled;
- review recent account activity;
- change reused passwords on other accounts;
- notify your organisation’s IT/security team if it is a work account.
Does multi-factor authentication completely stop phishing?
No, but it provides an important additional layer of protection.
Some advanced phishing attacks can also attempt to steal session information or trick users into approving authentication requests. You should still verify suspicious messages even when multi-factor authentication is enabled.
Should I reply to a suspicious email to ask whether it is genuine?
Usually no.
Replying confirms that your email address is active and keeps you inside the attacker’s communication channel.
Instead, contact the supposed sender through a separate trusted method, such as a known phone number, official website, company directory or an existing conversation.
Can antivirus software detect every malicious email?
No.
Security software can block many known threats, but no security tool can detect every phishing message or malicious link.
Human verification remains an important part of email security.
Should I delete a phishing email immediately?
If it is a personal mailbox, report it as phishing or spam first when that option is available, then delete it.
For a business account, follow your organisation’s reporting procedure because the security team may need the message for investigation.
What is the safest rule when I am unsure about an email?
Do not click, do not open unexpected attachments and do not provide sensitive information until you verify the request independently.
Taking an extra minute to confirm a message is usually much easier than recovering a compromised account.
Final thoughts
You do not have to prove that an email is malicious before refusing to click. When something feels wrong, verify through a separate channel. That small pause is often enough to prevent credential theft, malware infection or financial fraud.
For a broader website-security checklist, see How to Secure a WordPress Website: Practical Beginner Checklist.
