Five checks to spot a phishing email before clicking

The short answer: Always verify the actual email address behind the display name, hover over links to inspect the exact domain without clicking, treat any message demanding immediate action with suspicion, and access services by typing the official URL directly into your browser.

Email remains the most common entry point for cyberattacks targeting individuals and businesses alike. While spam filters weed out the bulk of junk mail, more sophisticated phishing attempts still manage to slip into inboxes every day. The key to neutralising them does not lie in complex tools, but in establishing a methodical checking routine before interacting with any suspicious message.

1. The display name versus the actual address

Any sender can configure their email client to show a name like 'Google Support', 'Santander', or your own manager's name. However, the display name provides no technical guarantee of where the message actually came from.

• Expand the sender details: click or hover over the name to see the full email address displayed in brackets or parentheses.
• Inspect the domain after the @ symbol: a legitimate message from your bank will always come from the organisation's own domain, never from free webmail providers (such as Gmail or Outlook), nor from domains with unusual suffixes or deliberate typos (like swapping a lowercase 'l' for the number '1').

Taking the time to review this detail fits naturally into sound email management, where classifying and verifying senders prevents nasty surprises.

2. Inspecting the link without clicking

The text displayed in an email does not necessarily match the web address it directs you to. A button or hyperlinked phrase might appear entirely harmless, yet point to a server controlled by attackers.

• On a computer: hover your cursor over the hyperlink without clicking. The actual destination URL will appear in the bottom corner of your screen or in a small tooltip.
• Watch out for subdomains: the part defining who truly owns the page is the primary domain, immediately before the first forward slash after the protocol. For example, in security.bank.com.external-server.net/login, the actual site is external-server.net, not your bank.
• On a mobile or tablet: long-pressing a link to preview it carries the risk of accidentally tapping and opening it. If you have any doubts on your phone, leave it alone; open your browser independently and navigate there directly.

3. The trap of urgency and dire consequences

Fraudulent emails almost always exploit primal emotions: fear of losing access to an account, shock over an unexpected charge, or panic regarding an overdue invoice. Phrases like 'Your account will be suspended within 24 hours' or 'Payment failed: update your details now' are engineered to provoke a hasty, impulsive reaction.

When you are rushing through your workload, pause for a moment. Taking the time to plan your day before opening email dramatically reduces the likelihood of falling into traps designed to catch you off guard.

4. Suspicious attachments and uncommon formats

Phishing does not always aim to trick you into entering credentials on a spoofed website; sometimes it tries to execute malicious code on your machine via an attachment.

• Be wary of compressed archives (.zip or .rar) that claim to contain an invoice or delivery note.
• Avoid opening documents that prompt you to enable macros or dynamic content to view them.
• Look out for misleading extensions, such as double file names (for example, invoice.pdf.exe).

5. The principle of independent access

If, after checking the message, you still harbour reasonable doubt about whether a notification from your bank, a courier service, or your email provider is genuine, apply one golden rule: never use the links inside the email.

Open a new browser tab, manually type in the service's official website address, or open the organisation's official app on your phone. If there genuinely is a pending alert, an unpaid bill, or a requirement to update your password, that notice will be clearly visible on your official account dashboard once you log in.