How to Spot a Phishing Email in 2026
Phishing emails used to be easy to laugh at — broken English, a prince, a fortune. The current generation is written better than most legitimate marketing, and catching it requires looking at different things.
The decode
The decode. Modern phishing works by urgency and imitation, not by looking fake. The tells that still hold up: the sender's actual address, not the display name — 'Microsoft Support' means nothing, but an address ending in a domain that isn't microsoft.com means everything. Links that display one address but point to another, which you can check by hovering or long-pressing before tapping. Pressure to act immediately, especially around money, accounts being closed, or packages being held. And any email that asks you to verify credentials, confirm a payment, or open an unexpected attachment, even from someone you know — compromised accounts are how most phishing spreads. When in doubt, don't use the link in the email at all: open the site or app directly and check whether the claimed problem actually exists.
The catch
The catch. The hardest phishing to spot comes from real accounts — a colleague's compromised email sending you a genuine-looking invoice, or a thread you're already part of suddenly containing a malicious attachment. No checklist fully covers that, which is why the habit that matters most isn't spotting fakes but verifying requests: any message asking for money, credentials, or sensitive files gets confirmed through a second channel before you act. That's slower. It's also the only defense that works when the email itself is flawless.
The bottom line: You won't catch every phishing email by looking at it — you'll catch it by never acting on one without checking through a route you chose yourself.
Cyphera Press may earn a commission from some of the links on this site. This doesn't affect our reviews or opinions.