How to Spot a Phishing Email in 10 Seconds: A Practical Guide for Non-Techies

Most phishing emails are not clever. They are cheap, sent by the thousand, and built to catch whoever is tired, rushed, or worried enough to click. The good news is that the tells are usually visible in the first few seconds, before you open an attachment or type a password. You do not need security software or a technical background to catch them. You need a short, repeatable habit and the willingness to pause for ten seconds.

The Sender Line Is Where Most Fakes Fall Apart

Display names lie. Anyone can set their name to "PayPal Support" or "HR Department" in their mail app. What matters is the actual address behind that name. On a phone, tap the name to expand it. On desktop, hover over it or open the full message header.

• A domain that almost matches a real one: paypa1.com, micros0ft-support.net, yourbank-secure.info
• Free mail accounts pretending to be a company: billing@companyname.gmail.com
• Long strings of random characters before the @ symbol
• A reply-to address that differs from the sender address

Here is the useful shortcut: if an email claims to come from a bank, a courier, or a service you actually use, the domain should be exactly that organisation's domain. Not a version with extra words bolted on. Not a hyphenated cousin. Exactly.

The Ten-Second Scan: Greeting, Details, and Polish

Legitimate organisations that hold your account usually know who you are. They reference something specific: the last four digits of a card, an order number, an account ending, the date you signed up. Phishing messages often open with "Dear Customer" or "Dear Valued Member" because the sender has a list of addresses and no names to go with them.

Then look at the writing. Plenty of phishing emails are fluent, so do not rely on clumsy grammar alone. But oddities cluster: missing words, mismatched fonts pasted in from a template, an unusually stiff tone from a company you deal with weekly, a logo that looks stretched or slightly off-colour.

• A footer with no physical address and no unsubscribe link
• A signature naming a person with no phone number or role that matches the company
• A message sent at 3 a.m. local time from a "colleague" who works your hours

Pressure Is the Product

Phishing works on emotion, not logic. The message wants you to act before you think, because thinking is where it falls apart. Watch for these levers being pulled:

• Fear: your account will be closed today, a payment failed, a parcel is held, a suspicious login was detected.
• Urgency: "within 24 hours", "immediate action required", "final notice".
• Authority: the message appears to come from a manager, IT, the tax office, or the police.
• Secrecy: "please do not discuss this with anyone". That line exists to keep you away from a second opinion.
• Reward: a refund, bonus, or prize you never entered for.

Any one of these is worth a second look. Two or three together in a single email is a strong signal to slow down.

Links Say One Thing and Do Another

Hover over a link before clicking. On a phone, press and hold to preview the address. Then read it from the first single slash after the domain, because that is where the real destination sits. Everything before it can be dressed up as a subdomain: realbank.com.secure-login.xyz actually takes you to secure-login.xyz, and no amount of "realbank" in the middle changes that.

Other quick checks: shortened links in an email you were not expecting, buttons whose destination does not match their label, and anything that asks you to log in just to view an invoice or a shared document. A padlock in the address bar does not mean the site is honest; it only means the connection is encrypted. Plenty of phishing sites have padlocks.

Attachments, Especially the Ones You Did Not Ask For

Treat these with suspicion: HTML files, zip archives, spreadsheets that ask you to "enable macros", and documents that lead straight to a login page when opened. PDFs get used as carriers for links too. If you can preview a file name and extension without downloading it, do that first. Two extensions, as in invoice.pdf.exe, always means trouble. So does a file whose name suggests a receipt, a delivery note, or a CV you never requested.

When the Message Comes From Someone You Trust

This is the hardest case. The address is genuinely your colleague's, your friend's, or your supplier's, because their account has been taken over. The style may be slightly off. The request is unusual: a payment to a new bank account, gift cards for a "client", a file you were not expecting.

Apply the same rule you would use for a stranger: verify through a different channel. Call the person on a number you already have. Do not reply to the email asking "is this really you?" — if the account is compromised, the attacker writes the reply. For any change of payment details, confirm by voice with a known contact before money moves. That one habit blocks a large share of business email fraud.

What to Do in the Next Two Minutes

If something feels off, stop. Do not click, do not reply, do not forward it to a colleague "to check".

1. Leave the message alone and close it.
2. Report it with your mail provider's "report phishing" button, or forward it to your IT team.
3. Delete it.
4. If you already clicked and entered details, change that password straight away, switch on two-factor authentication, and contact the company using a number from its official website, not from the email.
5. Tell someone. Embarrassment keeps people quiet, and quiet people lose more money than cautious ones.

If money has already left an account, call your bank immediately; the timing matters and they have processes for exactly this. For anything involving large sums, contracts, or legal exposure, speak to a qualified professional rather than handling it alone.

Ten seconds of checking beats an hour of cleanup. Make the sender line and the hover a reflex, and you will catch the overwhelming majority of these messages before they catch you.

Photo: geralt / Pixabay