A phishing email almost always shows at least one of five tells: a sender address that doesn’t match the real company, a link that goes somewhere different from what it claims, urgent or threatening language, sloppy grammar, or an unexpected attachment. Checking these five things takes about 15 seconds and stops most phishing attempts before they cost you anything.
Phishing emails are still the single most common way criminals steal passwords, credit card numbers, and identities. They’re built to look like they came from your bank, your employer, a delivery company, or even a friend — but one wrong click can hand over your login credentials or install malware on your device.
The scale of the problem has grown sharply. According to the FBI’s Internet Crime Complaint Center (IC3), reported phishing losses jumped from $70 million in 2024 to $215.8 million in 2025 — more than a threefold increase — even though the number of complaints barely moved.
Attacks are getting fewer in number but far more costly per victim, largely because scammers are using AI to write more convincing messages and target specific people rather than blasting generic spam.
A Real Example: The Fake FBI “Recovery Agent” Scheme
Phishing doesn’t always start with a sloppy email full of typos. Between December 2023 and February 2025, the FBI received more than 100 complaints about scammers impersonating employees of its own Internet Crime Complaint Center.
In one documented version of the scheme, criminals created fake social media profiles posing as fellow fraud victims, joined support groups for people who’d already lost money to scams, and then directed real victims to contact a persona calling itself “Jaime Quin,” supposedly the “Chief Director” of IC3. “Quin” claimed to have recovered the victims’ stolen funds — but the real goal was to extract financial account details and victimize them a second time.
The FBI has stated plainly: IC3 will never contact you by phone, email, social media, or messaging apps, and it will never ask for payment to release recovered funds. The case is a useful reminder that phishing increasingly relies on impersonating trusted authorities — including the very agencies people turn to for help — rather than obviously fake “you’ve won a prize” messages.
The 5 Signs of a Phishing Email
1. The Sender’s Address Doesn’t Match
Look past the display name — it can say “Bank of America Security Team” while the actual address reads something like `support@secure-bank1099-alerts.com`. Tap or hover on the sender’s name to reveal the full email address, and compare it letter-by-letter to the company’s real domain.
Scammers frequently use lookalike domains (extra words, hyphens, or a different top-level domain like `.info` instead of `.com`) that are easy to miss at a glance.
2. The Link Doesn’t Go Where It Claims
Hover your cursor over any link (or press and hold on mobile) without clicking to preview the actual destination URL. If the preview shows a domain that doesn’t match the sender, includes a string of random characters, or uses a link shortener hiding the real address, don’t click it.
Even links that appear to include the real company name can be spoofed with subdomains designed to fool a quick glance, such as `bankofamerica.verify-account-now.net`.
3. The Message Pressures You to Act Immediately
Phishing thrives on urgency because panicked people skip verification steps. Common phrases include:
– “Your account will be suspended in 24 hours”
– “Unusual sign-in detected — verify immediately”
– “Final notice: payment overdue”
The FTC’s guidance is direct on this point: legitimate businesses give you time to think before you have to act. Any message demanding an instant response is a red flag on its own, regardless of what else it says.
4. Grammar, Formatting, or Design Feels Off
Real companies proofread their communications and use consistent branding. Watch for generic greetings (“Dear Customer” instead of your name), inconsistent fonts or logo quality, and awkward phrasing that reads like it was translated or generated in a hurry. That said, don’t rely on this sign alone — AI writing tools have made grammatically perfect phishing emails increasingly common, which is part of why reported losses have climbed even as complaint volume has flattened.
5. There’s an Unexpected Attachment
Never open an attachment you weren’t expecting, even if it appears to come from someone you know — their account may have been compromised. Malware is frequently disguised as invoices, shipping confirmations, resumes, or “important documents.” If in doubt, contact the sender through a separate channel (a text or phone call, not a reply to the email) to confirm they actually sent it.
How to Verify a Suspicious Email in Under a Minute
1. Don’t click anything yet – Not the link, not “unsubscribe,” not the attachment.
2. Check the sender’s full address – not just the display name.
3. Hover over the link – to preview the real destination.
4. Ask yourself – Do I actually have an account with this company, or know this person? If the answer is no, it’s almost certainly phishing.
5. If the answer is yes – don’t use any contact info from the email. Go directly to the company’s website by typing the address yourself, or call the number printed on your card or a past statement.
What to Do If You Already Clicked or Entered Information
If you clicked a phishing link, opened an attachment, or entered your credentials before realizing something was wrong, acting quickly limits the damage.
1. Disconnect from the internet – if you downloaded a file, to stop malware from communicating out.
2. Change your password immediately – for the affected account — and for any other account where you reused that password.
3. Turn on two-factor authentication (2FA) – if it isn’t already active, so a stolen password alone isn’t enough to get in.
4. Check your account activity – for logins, purchases, or changes you didn’t make.
5. Contact your bank or card issuer directly – using the number on your card if you entered financial information, and ask about a card freeze or replacement.
6. Run a malware scan – on your device if you opened an attachment or downloaded a file.
7. Report it – Forward the phishing email to the Anti-Phishing Working Group at reportphishing@apwg.org, and file a report with the FTC at ReportFraud.ftc.gov or the FBI’s IC3 at ic3.gov.
8. Watch your credit – If you shared a Social Security number or other identifying details, consider a free credit report check at annualcreditreport.com and a fraud alert with one of the three credit bureaus.
Quick Prevention Checklist
– Enable your email provider’s spam filter — most catch a majority of phishing attempts by default.
– Turn on two-factor authentication for email, banking, and any account that supports it.
– Never send passwords, Social Security numbers, or account numbers by email.
– Bookmark the real login pages for your bank and other sensitive accounts instead of clicking email links.
– When in doubt, contact the company using a phone number or website you already know is real.
People Also Ask
Check whether the sender’s actual email address matches the company it claims to be from, hover over links to preview their real destination before clicking, and be suspicious of any message that pressures you to act immediately. If you don’t have an account with the company or don’t know the sender, treat the message as phishing.
Simply opening an email is usually low-risk. The danger comes from clicking links, opening attachments, or entering information. If you only opened the message without clicking anything, delete it and consider reporting it — no further action is typically needed.
It’s rare but possible if an email contains malicious code that runs when the message loads images or previews. This is one reason many email clients block automatic image loading from unknown senders by default. Clicking links or opening attachments remains by far the most common way phishing succeeds.
Forward it to the Anti-Phishing Working Group at reportphishing@apwg.org, and if you lost money or personal information, file a report at ReportFraud.ftc.gov or ic3.gov. Most email providers also have a “Report phishing” option in the message menu.
No. While poor grammar is a classic warning sign, AI writing tools have made grammatically clean phishing emails increasingly common. Sender address, link destination, and urgency are more reliable checks than spelling alone.
Sources: FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report and IC3 Impersonation Scam Alert; Federal Trade Commission, “How To Recognize and Avoid Phishing Scams” (consumer.ftc.gov)*
Related Posts:
What to Do If You Fall for an Online Scam
Smishing Text Scams
