# Spotting phishing attempts > Real examples of fake emails and messages, and the red flags that give them away before you click. *Source: https://velstech.net/spotting-phishing · Updated: 2026-09-04 · Category: Security & Privacy · Tags: Phishing, Awareness* *Markdown version of [Spotting phishing attempts](https://velstech.net/spotting-phishing). [Read the full guide with interactive tools](https://velstech.net/spotting-phishing).* *Also as Markdown: [Hindi](https://velstech.net/spotting-phishing.hi.md) · [Tamil](https://velstech.net/spotting-phishing.ta.md).* --- Phishing is the number one way people actually get compromised – not sophisticated hacks, but a fake email that looks just real enough to fool someone in a hurry. The good news: every phish leaves clues. Here's how to spot them. ## What phishing is Phishing is pretending to be someone you trust to get your password, money, or personal data. It arrives by email, text (smishing), phone (vishing), or fake websites. The attacker creates urgency, drops a plausible story, and waits for one careless click. ## The 7 red flags If a message hits any of these, treat it with suspicion: ### 1. Urgency or fear ``` "Your account has been locked!" "Action required within 24 hours!" "Your payment failed – verify now or you'll lose access!" ``` Legitimate companies don't threaten you into acting fast. Urgency is the #1 tool of phishers – it short-circuits your judgment. When something pressures you, slow down. ### 2. A suspicious sender address Check the actual email address, not the display name. The display name can say anything; the address is the truth. ``` ❌ "paypa1-security@update-now.xyz" ❌ "support@amazon-billing.com" (not amazon.com) ✅ "no-reply@paypal.com" ✅ "help@github.com" ``` Hover over links (don't click) and look at the real URL. The text may say "paypal.com" while the link goes to `paypal.verify-account.net`. ### 3. Generic greetings Real companies usually use your name. "Dear valued customer" or "Hello user" is a mass-sent phishing tell – the sender doesn't know who you are. ### 4. Grammar and typos One typo doesn't mean phishing, but poor grammar, weird phrasing, or odd formatting is common in scams. Official mail is usually clean. ### 5. Requests for information **No legitimate service will ever ask for your password, PIN, or OTP code** in an email or message. Anyone who asks is a scammer, no matter what they claim. ### 6. Unexpected attachments An invoice, a "receipt", a "report" you didn't ask for – attachments are how malware gets in. If you weren't expecting a file, don't open it. ### 7. Too good to be true "You won a gift card!", "unexpected tax refund", "claim your free crypto". If it sounds too good to be true, it's a hook. ## A real-world example, annotated ``` Subject: URGENT - Your Netflix account has been suspended ───────────────────────────────────────────────────── [🔴] Urgency: "URGENT", "suspended" Dear customer, [🔴] generic greeting We have noticed unusual activity on your account. [🔴] fear + vague Click below to verify your billing information [🔴] "verify" = give data within 24 hours or your account will be cancelled. [🔴] deadline pressure Veriy your account now: [🔴] typo "Veriy" [ http://netflix.account-update.ru ] [🔴] not netflix.com ───────────────────────────────────────────────────── Sincerely, Netflix Billing [🔴] no name ``` That's seven red flags in one message. Real Netflix mail has your name, no threats, and links to netflix.com. ## What to do when you spot one - Don't click anything – no links, no attachments, no "unsubscribe" (that just confirms your address works). - Don't reply. - If it claims to be a service you use, go to the service directly – open a new tab, type the real address, and check your account there. - Report it. Most email providers have a "Report phishing" button. Gmail, Outlook, and Apple Mail all do. - If you clicked or entered data, act fast: change the password, enable 2FA, and contact the real company's support. ## Extra protection layers - 2FA – even if your password leaks, a second factor keeps the account safe. - Password manager – it won't autofill on a lookalike domain, which itself is a warning sign. - Check messages directly – instead of clicking links in email, open the app or website yourself. - On your phone, be extra careful with SMS – "package delivery" texts with links are a huge current scam. ## The mental habit You don't need to memorize every red flag. Remember one rule: > When a message makes you feel rushed or scared and asks you to click or reply – > stop. Verify through a separate, known-good channel first. Phishing works on emotion, not logic. Slow down, and it fails every time. ## FAQ **What is the most common sign of a phishing email?** Urgency or fear – 'your account is locked', 'verify within 24 hours'. Legitimate companies don't threaten you into acting fast, because pressure is the tool that short-circuits your judgment. When you feel rushed, slow down. **How do I check if a sender address is real?** Look at the actual email address, not the display name – the display name can say anything. 'paypa1-security@update-now.xyz' is fake even if it says 'PayPal'; 'no-reply@paypal.com' is the real domain. Hover over links to see where they truly go. **What should I do if I get a suspicious email?** Don't click links or attachments, don't hit 'unsubscribe' (it confirms your address works), and don't reply. If it claims to be from a service you use, open a new tab, type the real address yourself, and check your account there. --- *VelsTech – technology explained for everyone. Original: https://velstech.net/spotting-phishing*