How to identity a phishing email

Phishing is an email that impersonates a trusted person or organization to trick the recipient into clicking a link, opening an attachment, or replying with sensitive information. It is the most common starting point for account takeovers, ransomware infections, and business email compromise, not because the technique is sophisticated, but because it targets a person's judgment in the moment rather than a gap in software.

For years, the standard advice was to look for typos, awkward phrasing, and generic greetings. That advice is far less reliable today. Generative AI has made it trivial for attackers to produce polished, well-written, personalized messages at scale, and reports from major threat intelligence teams now put a large share of phishing attempts as AI-generated. Spotting phishing reliably means checking the mechanics of a message, the sender details, the headers, and the links, rather than relying on tone or writing quality alone.

This guide covers the tactics attackers rely on and the specific things to check in a suspicious email before you act on it.

How a phishing email is built

Nearly every phishing email combines the same three ingredients, regardless of how convincing the writing is.

1. A trusted identity to impersonate. A company the recipient does business with, an executive at their own organization, IT support, a delivery service, or a well-known brand.
2. A reason to act immediately. An overdue invoice, a suspended account, a missed delivery, a document awaiting a signature, or a request from a manager.
3. A single action that does the damage. Click a link, open an attachment, scan a code, or reply with information.

Recognizing this structure is often more useful than trying to spot a single obvious mistake, because the structure doesn't change even as the writing quality improves.

Common phishing tactics

• Urgency and threats. Messages that warn of account suspension, unauthorized login attempts, unpaid invoices, or legal action, designed to make the recipient act before thinking it through.
• Authority impersonation. An email that appears to come from a CEO, a manager, IT support, or a known vendor, asking for a favor that's slightly outside normal process, such as approving a payment or resetting a password.
• Fake document and e-signature notifications. Messages mimicking DocuSign, Google Drive, or similar services, prompting the recipient to log in to "view a document," which leads to a fake login page.
• Reply-chain hijacking. An attacker who has compromised one mailbox replies inside a genuine, existing email thread, which makes the message far more convincing because the surrounding context is real.
• QR code phishing (quishing). A malicious link is embedded inside a QR code rather than written as text, often inside a PDF attachment. This has grown quickly because many email security tools scan text and links but can't inspect a URL hidden inside an image, and because scanning happens on a phone that may sit outside the organization's normal security controls.
• Lookalike and spoofed senders. Messages that use a domain resembling the real one, or forge the visible From address entirely. For more on how sender forgery works at the protocol level, see our guide on email spoofing and how SPF, DKIM, and DMARC address it.

What to check in the sender details

• Display name versus actual address. A message can show "IT Support" or a colleague's real name while the underlying email address is unrelated. Always check the actual address, not just the name shown in the inbox list.
• Exact domain versus lookalike domain. Look closely at the domain after the @ symbol. Attackers commonly substitute a letter for a similar-looking one, add an extra word or hyphen, or use a different top-level domain than the real organization does.
• Free or generic email providers for supposedly corporate mail. A message claiming to be from a company's finance department but sent from a personal Gmail or Outlook address is a strong signal something is wrong.
• A Reply-To address that differs from the From address. Some mail clients hide this by default. If a reply would go somewhere different from where the message claims to originate, that mismatch is worth investigating before responding.

What to check in the headers

Most email clients let you view the full, raw headers of a message, usually through an option like "show original" or "view source." A few fields are worth checking directly:

• Authentication-Results. This header shows whether the message passed SPF, DKIM, and DMARC checks. A failure here, especially a DMARC failure, is a strong indicator that the visible sender was forged.
• Received headers. These trace the path a message took across mail servers, listed in reverse order from the most recent server to the original sending server. A mismatch between the originating server and the domain the message claims to be from is a red flag, though this takes some familiarity with header formats to read confidently.
• Return-Path. This is the envelope sender used for bounces, and it often differs from the visible From address even in legitimate mail, for example when using a marketing platform. What matters is whether it points somewhere plausible for the claimed sender, not whether it matches exactly.

Checking headers isn't something most people will do for every email, but it's the most reliable way to confirm a suspicion when a message looks slightly off but you can't tell why.

What to check in links

• Hover before you click. On desktop, hovering over a link shows the actual destination URL, usually in a status bar at the bottom of the window. Check whether it matches the domain the message claims to be from.
• Watch for URL shorteners and redirect chains. A shortened link hides its true destination until it's clicked, which is exactly why attackers use them. Treat any shortened or redirecting link in an unsolicited email with caution.
• Compare anchor text to the actual link. A link that displays as one URL can point somewhere else entirely, since the visible text and the underlying destination are set independently in an HTML email.
• Treat QR codes like links, not images. A QR code in an email or attachment is a link you can't preview by hovering. If a message asks you to scan a code to verify an account or view a document, be as cautious as you would with any unfamiliar link, and consider whether the request makes sense coming through email at all.

What to check in attachments

• Unexpected attachments from any sender, including known contacts, since a compromised account can send a malicious attachment from an otherwise legitimate address.
• Unusual file types, particularly executables, ZIP or ISO archives, and HTML files attached to an email, which are common ways to smuggle malware or a fake login page past filters that focus on links.
• Macro-enabled Office documents that prompt you to "enable content" or "enable editing" to view something, a common technique for running malicious code once a document is opened.
• PDFs containing embedded links or QR codes, which have become a common way to route around security tools that scan message text but not the contents of an attached file.

Other signals worth checking, with caveats

• Generic greetings and mismatched personal details ("Dear Customer" from a company that should know your name) are still worth noticing, but attackers increasingly personalize messages using information scraped from public profiles, so a message using your correct name and title is no longer strong evidence of legitimacy on its own.
• Spelling and grammar used to be one of the most reliable signals. It's a much weaker one now. AI tools let attackers produce fluent, error-free messages in any language, so treat clean writing as neutral rather than reassuring.
• Requests for credentials, payment, or gift cards by email. Legitimate IT departments and vendors don't typically ask for passwords by email, and legitimate finance requests rarely arrive as urgent, one-off instructions to buy gift cards or wire funds outside normal process.
• Slightly off branding. Low-resolution logos, unusual fonts, or a layout that's almost but not quite right can still be a useful tell, particularly in mass-sent phishing that hasn't been tailored to a specific target.

What to do if you suspect a phishing email

• Don't click links, open attachments, or scan QR codes in the message.
• Don't reply to the sender, even to ask if the message is legitimate. This confirms the address is active and monitored.
• Verify through a separate, known channel. If the message claims to be from a colleague, vendor, or bank, contact them using a phone number or website you already know to be correct, not any contact information included in the email itself.
• Report it using your organization's phishing reporting tool or by forwarding it to your security team. Reporting matters even if you didn't fall for it, since it helps flag the campaign for others who received the same message.
• Delete or quarantine it once it's been reported, rather than leaving it in an inbox where it could be accidentally clicked later.

What organizations can do

Individual vigilance matters, but it isn't a complete defense on its own, especially as AI narrows the gap between real and fake messages. A few structural measures reduce how often a well-crafted phishing email reaches an inbox in the first place, and how much damage it can do if it does:

• Enforce SPF, DKIM, and DMARC with a policy of p=reject to stop forged mail using your own domain from reaching recipients, and to make it harder for attackers to spoof your organization when targeting others.
• Deploy email security tooling that inspects attachments and embedded images, not just message text and links, given how much phishing has shifted toward PDFs and QR codes specifically to evade text-based scanning.
• Run regular phishing simulations so employees encounter realistic attempts in a low-stakes setting and build the habit of checking sender details and links before acting.
• Move toward phishing-resistant authentication, such as passkeys, so that a successful phishing click resulting in a submitted password doesn't automatically hand over the account. A stolen password is far less useful to an attacker if the account also requires a hardware-bound credential to complete sign-in.

The bigger picture

Phishing hasn't gotten more sophisticated in concept. It still relies on urgency, trust, and a single click. What's changed is execution: AI has removed the writing quality gap that used to make many phishing attempts obvious, and attackers have moved toward formats like QR codes and PDF attachments specifically because they slip past defenses tuned for plain text and links.

That shift means the old checklist of typos and generic greetings can't carry the weight on its own anymore. Checking the actual sender address, the authentication headers, and where a link or code really points is now the more reliable habit, backed by organizational defenses like DMARC enforcement and phishing-resistant authentication that limit the damage when a message inevitably gets through.