How to Spot a Phishing Email: A Fake One, Taken Apart Piece by Piece
Last updated: November 5, 2026 · Steps checked against FTC, CISA, Google, and Microsoft guidance (sources at the bottom)
We may earn a commission if you buy through links here — it never changes our picks.
Phishing is a fake message dressed up as one you trust. The sender pretends to be your bank, a delivery company, a supplier, or a service you use, and the message tries to get you to do one of three things: click a link and log in on a lookalike page, open an attachment that installs malicious software, or hand over information or money directly.
Most people believe they would spot a fake. Fakes used to deserve that confidence: they were full of typos and strange phrasing. Modern phishing copies the real company's logos, layout, and tone almost perfectly, because copying is easy. What a scammer cannot easily copy is the plumbing underneath: the true sending address, the true destination of the links, and the way a real company behaves when there is a problem. That is where this guide looks: one realistic fake, taken apart piece by piece, then the five checks that work on any message.
For a small business this matters twice over. One click by anyone with access to the shared mailbox can hand over the account that resets every other password. And the costliest variant is a polite email, apparently from a regular supplier, saying their bank details have changed. The checks below, especially the phone verification, are built to catch both.
Ground rules for inspecting a suspicious email
- Do not click anything in the message while you inspect it. Not the button, not the logo, not the unsubscribe link. Every check in this guide can be done without clicking.
- Do not open the attachment, if there is one, and do not call any number printed in the message.
- Suspicion is enough. You never have to prove a message is fake before ignoring it. A message earns your click by passing the checks, not the reverse.
Meet the fake: one email, piece by piece
Here is a composite fake, built from the patterns the FTC and CISA describe. We have defused it: the addresses use a placeholder ending, so nothing here is clickable. A live one would use a lookalike domain instead, which is the first tell.
From: Account Security Team <[email protected]>
Subject: URGENT: Your account will be suspended in 24 hours
"Dear Valued Customer,
We detected unusual sign-in activity on your account. For your protection, we have limited what your account can do. To restore full access, verify your information immediately using the secure link below.
[ Verify My Account ]
If verification is not completed within 24 hours, your account will be suspended and scheduled for closure. Your latest statement is attached for reference (Statement.pdf).
Thank you for your prompt attention to this matter."
Read it once as its author hopes you will: quickly, slightly worried, on a phone, between other tasks. Now read it as an inspector. Five things are wrong with it, and each maps to a check you can run on any email:
- The sender's address is invented. "Account Security Team" is just a display name, which anyone can type. The domain behind it belongs to nobody you do business with. Check the sender →
- The button hides its destination. The link text promises security. Where it actually leads is answered by hovering. Check the links →
- It greets nobody. A company holding your money knows your name. "Dear Valued Customer" is written for ten thousand strangers at once. Read it for pressure →
- It runs on a deadline. Twenty-four hours, suspension, closure. Urgency is not a side effect of phishing, it is the mechanism. Read it for pressure →
- The attachment is a second hook. If the button does not get you, curiosity about the statement might. Check the attachments →
Notice what is not on that list: spelling. This fake is cleanly written, and plenty of real ones are too. Errors are a bonus tell when they appear, never a requirement. The checks that follow work on the polished fakes.
Check the sender
The display name on an email is free text. The address behind it is the evidence. CISA's guidance makes the core point: phishing addresses imitate a legitimate business by altering or omitting a few characters, close enough to survive a glance and different enough to be a domain the scammer controls.
Reveal the full address, not just the name
Tap or click the sender's name to expand it and read the actual address. In Gmail, Google's own advice is to check that the email address and the sender name match. A message from "Your Bank" sent from a long, unrelated address has failed before you read a word of it.
Read the domain from the right
The domain is the part after the @ sign. The real company name must sit immediately before the ending, like .com. Extra words in front of it, like our example's invented secure-mail-center, mean the address belongs to whoever owns that longer domain. Then read the company name letter by letter: swapped, doubled, or missing characters are the classic imitation, easy to miss at reading speed.
Ask the context question
Were you expecting this? Do you even have an account with this company? The FTC's version is simple: if a message asks you to click or open something, ask whether you even have an account with the company. If the answer is no, treat it as a likely scam, report it, and delete it. No further analysis required.
For the messages that pass, check the reply address
Compare the From address with the Reply-To address in the message's full details. If replies would go somewhere different from where the message claims to come from, treat it as fake until the sender proves otherwise another way.
Check the links and attachments
A link's visible text and its destination are two separate things, and phishing lives in the gap between them. CISA calls these spoofed hyperlinks, where the address that appears does not match the text you are hovering on. Every button, logo, and image can be a link too.
On a computer, hover before anything else
Rest the pointer over the link without clicking. Your browser or mail app shows the true destination. Read its domain the same way you read the sender's: the company's real name, immediately before the ending, with no extra words and no altered letters.
On a phone, long-press, or do not touch it at all
On most phone mail apps, pressing and holding a link previews its destination without opening it. Learn the gesture on a safe email first. If your app shows no clear preview, skip the link entirely and verify the other way, covered shortly.
Treat the attachment as a second message asking for trust
An unsolicited attachment is one of the standard ways malicious software is delivered, and "invoice" and "statement" files are the usual costumes. Ask the same context question: were you expecting this file, from this sender, today? Real statements and invoices also live inside your account, reachable without opening anything that arrived by email.
Score the result strictly
One link pointing at the wrong domain fails the whole message. There is no partial credit and no "probably fine." Real emails contain several links, and marketing ones sometimes route through tracking domains, which is why the rule is not "close enough." If the important link, the one asking you to log in, pay, or verify, does not plainly lead to the company's own domain, do not use it. Go there yourself.
Read it for pressure
Phishing copy is engineered around one emotion: hurry. The FTC describes the standard scripts. The message claims suspicious activity or log-in attempts, a problem with your account or payment information, a request to confirm personal information, an invoice you will not recognize, or a prize or refund waiting for you. Different stories, same engine: a reason to act before you think.
- A deadline or a threat. Suspended in 24 hours, closed, locked, fined. Real reminders do not generally pair a countdown with a single login link. That combination is the pattern.
- A request for information the sender should already have. Honest organizations will not email you to ask for your password, bank account number, card number, or Social Security number. A message that asks for any of those has identified itself.
- A generic greeting and an empty signature. "Dear Customer," no name, no phone number, no address in the signature block. CISA lists both as strong indicators, because bulk senders have none of your details.
- Sloppy spelling, grammar, or layout. Worth noticing when present, worth nothing when absent. Plenty of phishing is professionally written now. Never let clean copy talk you out of a failed sender or link check.
- An offer that arrives from nowhere. A refund, prize, or coupon you did nothing to earn, one click away. The click is the product.
The business version deserves its own sentence. A supplier's bank-details change, or a boss asking for gift cards quickly and quietly, may carry no link and no attachment at all. Nothing to hover, nothing to scan. The only tell is the request itself: unusual, money-shaped, and in a hurry. Only the next section settles that kind of message.
Verify it the other way
This is the strongest habit in the guide: it does not depend on judging a fake. Whatever the message claims, you confirm or dismiss it through a channel the message did not give you. If the claim is real, it will still be there when you arrive by your own route.
Use nothing from the message
No links, no buttons, and no phone numbers printed in it. The FTC is explicit about the numbers, including caller ID on a phone approach: contact details supplied by the message are part of the message, and a scammer answers their own phone politely.
Go the way you normally go
Open the company's app, or type the address you already know, or use a bookmark. Sign in there. A genuine problem, a real held delivery, an actual invoice: all exist inside the account, independent of any email.
If nothing is there, the message was the whole attack
No alert in the account means no problem to fix. The email failed by absence; report and delete it below.
For people and payments, call a number you already have
When the message claims to be from a person or company you deal with, verify by voice on a number from your own records: a previous statement, the back of your card, an earlier invoice. CISA's version for businesses: take contact information from previous statements, never from the request itself. For a bank-details change, read the new details back on that call before any money moves. Two minutes of awkwardness defeats the most expensive email scam there is.
When one lands: report, delete, recover
Three endings, depending on how far things went. All start the same way: stop interacting with the message.
You spotted it. Report it where you read it, because reporting trains the filters that protect everyone after you. In Gmail, open the message, click More (the three dots next to Reply), and choose Report phishing. In Outlook on the web, select the message and choose Report, then Report phishing, above the reading pane. Then delete it. Do not click its unsubscribe link either; CISA's instruction is simply to report and delete, and the unsubscribe is just another link from the same sender. Report the attempt to the FTC at ReportFraud.ftc.gov too.
You clicked, but entered nothing. Close the page. If you downloaded or opened an attachment, treat that more seriously: disconnecting the device from the internet limits what malicious software can do while you get help, and a work device goes straight to whoever handles your IT. Run your security software's scan. The right response differs for a page view and a launched file.
You entered a password or details. Act now, in this order:
- Change the password from the real site. Type the address yourself or use the app. Never go back through the email's link. If that password was reused anywhere, change those accounts too, email account first (our password manager setup guide covers the fix for reuse).
- Turn on multi-factor authentication or a passkey on the account while you are in it, so the stolen password alone stops being enough.
- If financial information or money is involved, contact the financial institution immediately using the number on your card or statement, tell them what was shared, and watch the account closely, per CISA's advice not to wait and see.
- If it was a work account or a work device, tell the person responsible right away, your manager, your IT provider, whoever that is in your business. Speed matters more than embarrassment.
- Report the scam to the FTC at ReportFraud.ftc.gov, and if identity information was lost, IdentityTheft.gov gives recovery steps based on what was taken. If accounts start appearing in your name, work through our identity theft guide: the warning signs, the free credit checks, and the freeze, in order.
For the shared-inbox version of all this: agree as a business that anyone can pause a payment or a login request for a verification call, with no penalty for being wrong. That one norm, written down, is worth more than any filter. It is also step 6 of our 7-step small business security checklist.
- Read the sender's real address, not the display name. Lookalike domain means fake.
- Hover or long-press every important link. Wrong destination domain means do not click.
- Never open an attachment you were not expecting.
- Urgency plus a login or payment request is the pattern. Slow down on purpose.
- No real company asks for your password, card, or bank details by email.
- Verify through your own route: the app, the typed address, or a number you already have.
- Report it in your mail app, delete it, and for money requests, make the call first.
Where these steps come from
Checked against the official sources below in November 2026. Mail apps rename menu items from time to time; the commands stay in the same neighborhood.