Most phishing emails give themselves away if you check three things: who actually sent it, where the link actually goes, and what it's asking you to do. The polish of the email tells you very little, because scammers copy real logos and AI writes clean English. Below are ten checks that still work, the scams you'll see most, and what to do if you've already clicked.
The 10 checks
1. Look at the address, not the name
The name you see in your inbox ("Royal Mail", "PayPal", "Your Bank") is just a label the sender types in. Anyone can set it to anything. Tap or click the name to see the actual address behind it. A delivery company doesn't send from a random free webmail account or a string of letters at a domain you've never heard of.
2. Read the domain character by character
Scammers register domains that look right at a glance. Watch for:
- Swapped or doubled letters, or "rn" standing in for "m"
- Extra words: the brand name plus "-secure", "-support" or "-refunds"
- A different ending: .co instead of .co.uk, .net instead of .com
- The brand name in the wrong place, such as yourbank.com.account-check.net
That last one catches people out. The real domain is the part just before the first single slash, read from the right. In yourbank.com.account-check.net, the site you'd be visiting is account-check.net, not your bank.
3. Check where the link really goes
The words in a link can say anything. What matters is the destination.
- On a computer: hover over the link without clicking. The real address appears in the bottom corner of the window or in a small pop-up.
- On a phone: press and hold the link instead of tapping it. Most mail apps show the full address in a preview or menu. Then let go without opening it.
If the link text says one site and the destination is another, treat the email as fake. Shortened links that hide the destination deserve the same suspicion in anything about your money or accounts.
4. Notice the pressure
"Your account will be closed in 24 hours." "Final notice." "Unusual sign-in detected, act now." Urgency and threats are there to stop you thinking. Real companies do send deadlines, but they rarely threaten you into clicking a link right now.
5. Ask what it wants you to do
Phishing always wants an action: log in, pay a fee, confirm card details, open a file, call a number. Be very wary of any email whose whole point is getting you to type a password or payment details into a page it links to.
6. Never share a code
If anyone asks you to read back or forward a verification code, it's a scam. Those codes exist to prove that you are you. Legitimate services don't ask you to send them a code you've just been sent, and nobody genuine from a bank or a tech company will ask for one by email, text or phone.
7. Be suspicious of attachments
Unexpected attachments are a common way in. Be especially careful with zip files, HTML files, and documents that ask you to "enable content" or "enable editing" to see them. If you weren't expecting a file, don't open it. Ask the sender through a different channel if it's someone you know.
8. Don't rely on spelling and grammar
Bad spelling used to be the classic giveaway. It isn't any more. Scammers use AI tools and copy real company emails word for word, so many phishing emails now read perfectly. A well-written email can still be fake, and the checks above matter more than the writing.
9. Ask how they got this address
If an email claiming to be your bank arrives at an address you never gave your bank, it's fake. This is one of the most reliable checks there is, and it's why keeping separate addresses helps (more on that below).
10. Check it another way
When in doubt, don't use anything in the email. Close it, open the company's app or type its web address yourself, and log in there. If there's a real problem, you'll see it. If you need to phone, use the number on your card, your statement or the company's own website, never the one in the email.
The scams you'll see most
| Scam | What it says | What it wants |
|---|---|---|
| Delivery | Missed parcel, pay to rebook | Card details |
| Bank or payment | Suspicious payment, verify now | Login, codes |
| Account suspended | Mailbox, streaming or cloud account locked | Your password |
| Prize or refund | You're owed money, claim it | Bank details |
| Invoice | Unpaid invoice attached | You to open a file |
| Fake sale | Huge discount, ends tonight | Payment on a fake shop |
Sale seasons and the run-up to Christmas bring more of the delivery and fake-sale kinds, timed for when you're expecting lots of parcels. The guide to temp mail for shopping has more on those.
What to do if you clicked or replied
Don't panic, and don't ignore it. Act in this order:
- If you only clicked and typed nothing, close the page. The risk is usually low, but keep an eye out for follow-up emails.
- If you entered a password, change it straight away on the real site, and on any other site where you used the same one.
- Turn on two-step verification for that account, so a stolen password alone isn't enough.
- If you gave card or bank details, call your bank using the number on the back of your card. Tell them what happened. They can block the card and watch for odd payments.
- If you shared a verification code, contact the service it was for and check the account's recent activity and linked devices.
- If you opened an attachment, run a security scan and update your device.
- Report it. In the UK, forward the email to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service. Then delete it.
It's also worth checking whether your address has turned up in known data breaches at Have I Been Pwned. Breached addresses tend to get more phishing.
How a separate address helps
Phishing works best when the fake email lands in the same inbox as the real ones. Splitting your addresses removes that cover:
- Give your bank, your main email account and anything to do with money your real address, and nothing else.
- Use an alias or a temp inbox for sign-ups, newsletters and one-off downloads.
Now a "your bank" email arriving at a sign-up alias or a throwaway inbox is obviously fake, because your bank has never seen that address. The email alias vs temp mail guide explains which to use where, and what temp mail is covers the basics.
What this site shows you
If you use the temp inbox here, a few things help with the checks above:
- Link tickets. Confirmation links get a ticket that shows the real destination domain. If the link text names one site but the link goes to another, the reader shows a warning.
- Images off by default. Emails open with remote images turned off, so senders can't use tracking pixels to see when you opened them. There's a Show images button if you want them.
- Check for spam. A button on each email sends that message's sender, subject and text to Google's Gemini model for a second opinion, and the row shows "Likely spam" or "Looks fine". It only runs when you press it, and it can be wrong, so use it alongside the checks, not instead of them.
The habit that beats almost every phishing email: never act on a link in a message you didn't expect. Go to the site yourself.
There's more on what AI can and can't spot in AI temp mail vs traditional burner email.