How to Tell If an Email Is Phishing: 10 Technical Warning Signs You Should Never Ignore

Phishing emails no longer arrive full of obvious spelling mistakes and Nigerian princes. Many now use clean formatting, real brand logos, and convincing language, which is why knowing how to tell if an email is phishing has become a technical skill rather than a matter of gut feeling. The good news is that a phishing message has to leave evidence somewhere: in the sender's address, in the destination of its links, in its hidden headers, or in what it asks you to do.

The ten warning signs below are ordered roughly from the checks that take a few seconds to the ones that require opening the message source. Working through them in this order lets you reject most fake emails quickly and save the deeper analysis for the messages that genuinely look convincing. No single sign is proof on its own, but two or three together are a strong case.

1. The Sender's Real Address Doesn't Match the Display Name

The name shown at the top of an email is just a label the sender chooses, and it can say anything. Security analysts consistently rank this mismatch among the most useful quick checks: the display name may read "PayPal Support" while the actual address ends in a domain that has nothing to do with the brand.

How to Check the Sender Address

Click or tap the sender's name to expand the full address, then read the domain (the part after the @ symbol) letter by letter. Lookalike domains swap characters, such as a number 1 in place of the letter l, or add extra words like "secure" or "login" to a brand name. Keepnet's guidance suggests comparing the address format against earlier legitimate messages from the same organisation.

2. The Link Destination Doesn't Match What the Link Says

A button labelled "Verify My Account" can point anywhere. Attackers rely on the fact that people read the label and not the destination. A common trick is placing the real brand name inside a longer address, so a link such as paypal.com.verify-user-login.xyz looks familiar at a glance but actually belongs to the domain at the very end, verify-user-login.xyz.

How to Preview a Link Safely

On a computer, hover the cursor over the link without clicking and read the address that appears in the bottom corner of the browser or email client. On a phone, press and hold the link to see a preview. Read the domain from right to left: the part immediately before the first single slash is what counts. To go further, paste the suspicious address into a scanner such as VirusTotal or urlscan.io, which check it against known malicious sites without you having to visit it.

The real destination of a link is always the domain just before the first slash, read from right to left.

3. Urgency, Threats, or a Deadline

Phishing depends on speed. A message that threatens account suspension, unpaid invoices, or legal action within 24 hours is designed to stop you from checking the other signs on this list. Legitimate organisations do occasionally send deadlines, but they rarely demand that you confirm a password or click through in minutes. Whenever an email creates pressure, treat the pressure itself as the warning sign and verify through a separate channel, such as the company's official website or a phone number you already trust.

4. Failed SPF, DKIM, or DMARC Checks in the Headers

Every email carries hidden headers recording the route it took and whether it passed three authentication checks. SPF confirms the sending server is authorised to send for that domain. DKIM confirms the message carries a valid digital signature and was not altered in transit. DMARC checks that the domain in the visible From line lines up with the results of the first two and tells receiving servers what to do if it does not.

How to View Email Headers

In Gmail, open the message, click the three dots, and choose "Show original." In desktop Outlook, open the message, then choose File, Properties, and read the Internet headers box. Look for the Authentication-Results line. An SPF, DKIM, or DMARC failure is a strong indicator that the sender is spoofing a domain, according to guidance from Sendmarc and CaptainDNS. If the raw text is hard to read, paste the headers into Google's Messageheader tool or the MxToolbox Email Header Analyzer for a plain-language breakdown.

Why a Pass Doesn't Guarantee Safety

This check has an important limit. An attacker who registers a lookalike domain can configure SPF and DKIM correctly for that fraudulent domain, so the message passes every test while still being a scam. Authentication only proves which domain sent the message, not that the domain is honest, which is why the sender-address check in section 1 still matters even when the headers look clean. Emails sent from a genuinely compromised account can also pass every test.

5. The Reply-To or Return-Path Points Somewhere Else

Attackers often use a From address that looks legitimate while quietly setting a different Reply-To address, so that your answer goes to their real mailbox. Analysts recommend reading the Reply-To header separately from the From header. A mismatch between the From domain and the Return-Path domain, which records where bounce messages are sent, is another indicator of spoofing. Both appear in the same raw headers described in the previous section.

6. An Unexpected Attachment, Especially HTML, ZIP, or ISO Files

Treat any attachment you were not expecting as unsafe, even if it appears to come from someone you know. Attackers increasingly use HTML attachments, which contain either a hidden redirect to a fake site or an entire fake login page written in JavaScript, so no website hosting is needed on their end. Kaspersky reported detecting nearly 2 million emails containing malicious HTML attachments in the first four months of one recent year. Compressed archives such as ZIP and disk-image files such as ISO are used for similar reasons: they can slip past simple attachment filters.

If you must inspect a file, upload it to VirusTotal rather than opening it, or confirm with the sender through a separate channel first.

7. A Generic Greeting Combined With a Request for Credentials

Messages beginning "Dear customer" or "Dear user" suggest a bulk send, particularly when the organisation ought to know your name. The greeting alone is weak evidence, since plenty of legitimate newsletters are generic, but combined with a request to log in, confirm personal details, or update payment information it becomes a meaningful signal. Real banks and services almost never ask you to enter a password after clicking a link in an email.

8. A QR Code Where a Link Should Be

QR-code phishing, known as quishing, hides the malicious address inside an image. This is deliberate: many email filters scan text for bad links but cannot read QR codes, and the victim never sees a URL to be suspicious of. Security firm Check Point reported that quishing attacks rose sevenfold in a single month in late 2023, and the technique has continued to appear in fake "re-authenticate your two-factor login" and "open this secured document" messages.

How to Handle an Emailed QR Code

Do not scan a QR code that arrives unexpectedly by email. If you already have, use a camera app that previews the address before opening it, read the domain carefully, and never sign in from the page that loads. Open the real website or app manually instead. Scanning is usually harmless on its own; the danger begins when you enter credentials or payment details on the destination.

9. Odd Wording, Formatting, or Grammar

Spelling mistakes and awkward phrasing remain a genuine warning sign, though a shrinking one, because modern attackers often use clean text. Look instead for subtler oddities: an unusual tone from a colleague, inconsistent branding, images that fail to load, or a signature that does not match the organisation's usual format. Treat polished writing as neutral evidence and awkward writing as a reason to look harder at the other signs.

10. A Request to Break the Normal Process

Perhaps the most reliable pattern of all is a message asking you to bypass how things are normally done: to pay an invoice to a new bank account, buy gift cards, keep a request secret, or move the conversation to a private messaging app. Business email compromise scams rely on this kind of request, often with an executive's name attached. Whatever the email claims, confirm through a trusted channel, such as a known phone number or internal chat, before acting.

A 60-Second Checklist

Expand the sender's address and read the domain letter by letter.

Hover over every link and read the real destination before clicking.

Ask whether you were expecting this message, attachment, or payment request.

Notice any pressure or deadline, and slow down when you feel it.

If still unsure, open "Show original" and look for SPF, DKIM, or DMARC failures.

Verify through a separate, trusted channel before entering credentials or sending money.

The Bottom Line

Knowing how to tell if an email is phishing comes down to checking a small number of things in a consistent order: who really sent it, where its links really go, what it wants you to do, and what its hidden headers say. No single test is perfect, and a polished attack may pass several of them, which is why the strongest defence is the habit of verifying anything urgent or unusual through a channel the sender did not choose. Spending sixty seconds on that habit costs far less than recovering a compromised account.

Sources

GlockApps — How to Spot a Phishing Email: 5 Clear Warning Signs

Sendmarc — How to Read Email Headers: A Comprehensive Guide

Trustifi — Email Header Analyzer: How to Spot Phishing and Spoofing

Keepnet — How to Spot Phishing Emails: Red Flags, Signals, and Indicators

Cybersecurity Campaign — How to Read Email Headers and Detect Spoofing

CaptainDNS — How to Spot a Phishing Email in 2026

Decryption Digest — Phishing Email Investigation 2026: Header Analysis

Tom's Guide — Avoid these email attachments if you don't want to get phished

Free Malaysia Today — Phishing with QR codes: watch out for 'quishing'

Trojan Killer — QR Code Phishing: How To Check a QR Link Before Scanning