Every day, 3.4 billion phishing emails are sent worldwide. That is not a typo. Attackers send more phishing emails in a single day than there are people on Earth — and one in every 100 emails sitting in your inbox right now is a phishing attempt.
The frightening part is not the volume. It is how convincing they have become.
Modern phishing emails do not arrive with broken English and promises of Nigerian princes. They look like your bank. They sound like your IT department. They feel urgent, professional, and completely legitimate — right up until the moment you click the link and hand over your credentials.
This guide walks you through the nine red flags that expose every phishing attempt, how attackers construct these traps, and exactly what you should do when one lands in your inbox.
What Is Phishing and Why Does It Keep Working?
Phishing is a cyberattack where an attacker impersonates a trusted entity — your bank, your employer, a courier service, a government body — to trick you into handing over sensitive information such as passwords, credit card numbers, or one-time PINs.
It works because it exploits human psychology rather than technical vulnerabilities. Attackers do not need to break into your system if they can convince you to open the door yourself.
The technique succeeds across three psychological levers:
Urgency — “Your account will be suspended in 24 hours.” Panic overrides careful thinking.
Authority — An email from your CEO, your bank, or a government department feels harder to question.
Familiarity — Logos, email formats, and language are copied so precisely that the fake is indistinguishable from the real thing at a glance.
The 9 Red Flags Every Phishing Email Contains
1. The Sender Domain Does Not Match the Organisation
This is the single most important check you can make, and it takes three seconds.
Look at the email address — not just the display name. Display names can say anything. “PayPal Security Team” is easy to fake. The domain after the @ symbol is harder to spoof perfectly.
Compare these:
- Legitimate: security@paypal.com
- Phishing: security@paypa1.com (numeral 1, not letter L)
- Phishing: security@paypal.com.phishingdomain.net
- Phishing: security@paypal-secure-account.com
Attackers use three tricks: character substitution (l → 1, O → 0), subdomain confusion (paypal.evil.com), and extra words (paypal-security.com). Train your eye to read the full domain character by character on any financial or sensitive email.
2. The Link Destination Does Not Match the Display Text
Hover your mouse over any link in an email before clicking it. The real destination URL appears in the bottom-left of your browser or email client.
If the link says “Click here to verify your account” but hovering reveals http://suspicious-login.xyz/verify, that is a phishing link. Legitimate organisations always link to their own verified domain.
On mobile, press and hold the link rather than tapping it to preview the destination.
3. The Email Creates Extreme Urgency
“Your account will be permanently deleted in 2 hours.” “Immediate action required.” “Last warning before legal proceedings.”
Urgency is a pressure tactic designed to stop you thinking rationally. Legitimate organisations give you reasonable time to act. Banks do not freeze accounts via email with a two-hour deadline. Tax authorities do not demand immediate payment through a link.
When an email makes you feel panicked, that panic is a signal to slow down, not speed up.
4. It Asks for Sensitive Information Directly
No legitimate organisation will ever ask for the following via email:
- Your password
- A one-time PIN or verification code
- Your full credit card number
- Your National Identity Card number
- Your bank account details
If an email asks for any of these directly — whether in a form, a reply, or via a linked page — it is almost certainly fraudulent.
5. The Greeting Is Generic
“Dear Customer.” “Dear Account Holder.” “Dear Valued Member.”
Your bank knows your name. Your mobile provider knows your name. Any organisation you have an account with addresses you by name in legitimate communications. Generic greetings are a strong indicator that the sender has your email address but nothing else — the hallmark of a mass phishing campaign.
6. The Email Contains Mismatched Branding or Subtle Errors
Attackers copy logos, colours, and email formats — but rarely perfectly. Look for:
- Slightly wrong shades of brand colours
- Fonts that do not quite match
- Low-resolution or pixelated logos
- Inconsistent spacing or formatting
- Footer information that does not match the organisation’s real address
One way to check: open the official website in a separate tab and compare the branding side by side.
7. Attachments You Were Not Expecting
An unexpected attachment — a PDF invoice, a Word document, a ZIP file — from anyone, including people you know, should be treated with extreme caution.
Phishing emails often carry malware disguised as:
- “Invoice_2026.pdf”
- “Updated Policy Document.docx”
- “Your Package Shipping Label.zip”
If you were not expecting an attachment, contact the sender through a separate channel (phone call, separate email) to verify they sent it before opening anything.
8. The Email Offers Something Too Good to Be True
Prize notifications. Unclaimed refunds. Lottery winnings. Inheritance funds. A part-time job opportunity that pays extraordinarily well.
If an email promises unexpected money or rewards that you did not specifically apply for or sign up to, it is a scam. Delete it.
9. The Request Bypasses Normal Channels
“Do not contact IT about this — it is being handled confidentially.” “Please process this payment directly and do not discuss with your colleagues.” “For security reasons, do not reply to this email — use the link below.”
Instructions that deliberately route around normal verification processes are a major red flag. Legitimate requests, especially financial ones, always welcome verification through official channels.
What to Do When You Receive a Phishing Email
Step 1 — Do not click anything. Not the link, not the unsubscribe button, not the attachment.
Step 2 — Do not reply. Replying confirms your email address is active and invites further attacks.
Step 3 — Report it. Forward the email to your IT department or security team. Most email clients have a “Report Phishing” button built in. In Gmail, click the three dots next to the reply button and select “Report phishing.”
Step 4 — Delete it. Remove it from your inbox and your deleted items folder.
Step 5 — If you clicked the link. Change your password immediately on the real website (navigate there manually, not via the email). Enable two-factor authentication if you have not already. Contact your bank if any financial information may have been exposed.
The Best Defence: Test Yourself Before Attackers Do
Reading about phishing red flags is useful. Practising spotting them under pressure is far more effective.
Our Social Engineering Awareness Quiz presents 20 realistic attack scenarios — phishing emails, fake SMS messages, fraudulent phone calls, and more — and tests whether you can identify the manipulation before it is too late. It takes 8 minutes and costs nothing.
Try the quiz before your next real phishing email arrives. The one after that might cost you considerably more than 8 minutes.
The Bottom Line
Phishing works because it targets people, not technology. No antivirus or firewall can stop an attack that you invited in yourself. The defence is awareness — knowing the patterns, slowing down when you feel pressure, and verifying before you trust.
The nine red flags in this guide cover the vast majority of phishing attempts in circulation today. Print them. Share them with your team. Make them a habit.
One second of scrutiny on a sender domain. Three seconds hovering over a link. That is all the time it takes to stop an attack that could otherwise cost your business everything.