Phishing Email Scam: How to Spot and Report Fraudulent Emails

What Is Phishing and Why Email Remains the Primary Attack Vector

Phishing is the practice of sending fraudulent emails or messages that appear to come from legitimate organizations (banks, PayPal, Microsoft, Apple, Amazon) to trick people into revealing sensitive information, downloading malware, or clicking malicious links. The term "phishing" refers to the act of "fishing" for sensitive data by dangling a seemingly legitimate email as bait.

Despite decades of security awareness, email remains the most effective attack vector for cybercriminals. According to Verizon's 2024 Data Breach Investigations Report, email is involved in over 80% of confirmed phishing incidents. The FBI reports that phishing and related scams cost organizations over $3.5 billion annually, with the average individual victim losing $1,200+ per incident.

Email is so effective for phishing attacks because:

• Scale: A scammer can send millions of phishing emails simultaneously at virtually no cost. Even if only 0.1% of recipients fall victim, that translates to thousands of compromised accounts.
• Legitimacy: Email appears more official and trustworthy than text messages or social media messages. People are conditioned to trust email from companies they do business with.
• Spoofing: Email headers can be spoofed to make it appear that an email comes from a legitimate address, even though it actually comes from the attacker.
• HTML tricks: Sophisticated phishing emails use HTML and CSS to hide real URLs behind displayed text, making malicious links appear legitimate.
• Time sensitivity: Phishing emails create urgency ("Your account will be closed in 24 hours!") that prevents careful evaluation.

The Five Major Types of Phishing Attacks

Not all phishing emails are created equal. Understanding the different types helps you recognize them in various contexts.

1. Spear Phishing: Spear phishing is targeted phishing directed at specific individuals or organizations. The attacker researches the target, often using information from LinkedIn, company websites, or social media, and creates a highly personalized email. For example, a spear phishing email might address you by name, reference your company's recent acquisition, and appear to come from a colleague or executive. Spear phishing is more sophisticated than mass phishing and has a higher success rate because the personalization increases credibility.

2. Whaling: Whaling is spear phishing targeting high-value victims: CEOs, CFOs, senior executives, or other high-net-worth individuals. Whaling emails are extensively researched and highly personalized. For example, a CFO might receive an email appearing to come from the CEO asking them to urgently wire funds for an acquisition. Whaling attacks often result in larger financial losses than standard phishing because the targets have access to substantial funds or sensitive information.

3. Clone Phishing: In clone phishing, the attacker intercepts or observes a legitimate email from a trusted organization and creates an almost identical copy with one key difference: a malicious link or attachment replaces the legitimate one. The attacker then sends the cloned email from an address that appears to come from the original organization. Recipients, expecting to receive emails from this organization, trust the clone. For example, you might receive what appears to be a follow-up email from your bank about a payment confirmation, but the link actually leads to a phishing site.

4. Smishing: Smishing is phishing via SMS text messages rather than email. A typical smishing attack involves a text message appearing to come from your bank: "Your account has been locked. Click here to verify your identity." The link leads to a phishing site where your credentials are captured. Smishing is effective because people are less suspicious of text messages than emails and are less likely to carefully inspect links in text messages.

5. Vishing: Vishing is phishing via voice call. In a vishing attack, a scammer calls you claiming to represent your bank, Microsoft, Apple, or another trusted organization. They claim there's a problem with your account and ask you to verify your information or log into your account while on the phone with them. The goal is to capture your login credentials or convince you to install remote access software. Vishing relies on the legitimacy of voice calls and the pressure of real-time conversation to prevent careful evaluation.

The Anatomy of a Phishing Email: Red Flags to Watch For

Most phishing emails contain identifiable patterns that distinguish them from legitimate emails. Learning to spot these patterns is essential to protecting yourself.

Spoofed Sender Address: The email appears to come from a legitimate company address, but the actual sender is different. For example, the display name shows "noreply@amazon.com" but the actual sender is "amazon-security@attacker.com". To check the actual sender, click "Show original" or "View message source" in your email client. Legitimate companies always send emails from their official domain.

Urgency Language: Phishing emails create artificial urgency to prevent careful thinking. Common urgent phrases include: "Your account will be closed in 24 hours!" "Unusual activity detected—verify immediately!" "Confirm your identity or lose access!" "Immediate action required!" Legitimate companies rarely create urgent situations that require immediate action via email.

Generic Greetings: Legitimate emails from companies you do business with use your name. Phishing emails often use generic greetings like "Dear Customer," "Dear User," or "Dear Valued Member." This is because the attacker doesn't have your specific name or is sending to a mass list. If an email from your bank addresses you as "Dear Customer" instead of using your actual name, it's likely phishing.

Suspicious Links: Hover over links in the email (don't click them) to see where they actually lead. If a link appears to come from Amazon.com but actually leads to amaz0n.com (with a zero instead of an O) or amazon-security.attacker.com, it's phishing. The displayed text may say "Click here to verify your account" but the actual link goes to a malicious site. Always hover before clicking.

Requests for Sensitive Information: Legitimate companies never ask for sensitive information via email. Banks won't ask for your password, PIN, social security number, or credit card number by email. If an email asks you to provide this information, it's phishing. Even if the email directs you to a website to enter this information, the website is likely a phishing site.

Unexpected Attachments: Phishing emails often include attachments with malware. Be wary of unexpected attachments, especially if the email is asking you to take action. Attachments named things like "Invoice.pdf.exe" (with a double extension) or "Updated_Password_Policy.docx" from unexpected senders are classic phishing tactics.

Poor Grammar and Spelling: Many phishing emails contain grammatical errors and spelling mistakes, especially if sent by attackers for whom English is not a native language. However, some sophisticated phishing emails have perfect grammar. Don't rely solely on this indicator, but it can be a red flag combined with other signs.

Mismatched Information: Phishing emails sometimes contain information that doesn't match legitimate company communications. For example, the email claims to be from Chase Bank but uses logos from a different bank, or the email claims you're a PayPal customer but you don't have a PayPal account.

How to Inspect Email Headers and Verify Sender Information

Email headers contain technical information about where an email actually came from. Learning to read headers helps you definitively determine if an email is phishing.

How to view email headers:

• Gmail: Open the email, click the three dots in the top right, and select "Show original." This displays the full email headers.
• Outlook: Open the email, click "File" and select "Properties." In the "Internet Headers" box, you'll see the email headers.
• Apple Mail: Open the email, click "Message" and select "Show All Headers."
• Other email clients: Look for "Show original," "View source," "View headers," or similar options.

Once you've displayed the headers, look for the "Return-Path" or "From" field. This shows the actual sender's email address (different from the display name). If the Return-Path is not from the legitimate company's domain, the email is phishing. For example, if an email claims to be from Amazon but the Return-Path is "no-reply@amazon-security.attacker.com," it's phishing.

Additionally, look for the "Received:" fields at the top of the headers. These show the path the email took through mail servers. If the email claims to come from Amazon but the first "Received:" server is from a suspicious domain or IP address, the email is likely phishing.

Safe Link Inspection: Verifying URLs Before Clicking

Before clicking any link in an email, verify that it actually leads to the legitimate organization's website.

Method 1: Hover Before Clicking Most email clients display the actual URL when you hover your mouse over a link. Don't click—just hover and look at the URL that appears. If the displayed link says "Click here to verify your account" but the actual URL is "attacker.com/phishing," don't click it. It's phishing.

Method 2: WHOIS Lookup If you're suspicious of a domain name, you can look up who owns it. Visit whois.com or whois.net and enter the domain name from the suspicious link. This shows who registered the domain and when. If the domain was registered recently and by someone other than the company it claims to be from, it's likely a phishing site.

Method 3: Direct Navigation If an email appears to be from your bank asking you to log in, don't click the link in the email. Instead, open a new browser tab, type in the bank's website address directly (from your browser history or a past statement), and log in through that method. This bypasses any malicious link in the email.

Method 4: Contact the Organization Directly If you're unsure about an email claiming to be from a company, contact that company directly using a phone number from your account statement or their official website. Don't use contact information from the suspicious email. Ask the company if they sent the email. Legitimate companies will always confirm or deny having sent a specific email and appreciate your caution.

HTML Email Display Tricks That Hide Real URLs

Sophisticated phishing emails use HTML and CSS to hide the real URL behind displayed text. Understanding these tricks helps you identify them.

HTML Link Trick: A link might display as "Click here to confirm your identity" but the actual URL leads to a phishing site. The HTML code looks like: <a href="attacker.com/phishing">Click here to confirm your identity</a>. If you hover over the displayed text, the actual URL appears in your browser's status bar (the small bar at the bottom of the screen).

Link Text Spoofing: A link might display as "https://www.amazon.com" but actually link to "attacker.com/phishing". The attacker uses the legitimate domain as the display text while the actual link goes elsewhere.

Tiny Font URLs: Some phishing emails include the real URL in very small font that blends into the background. When you read the visible content, you see "Click here to verify your account" and you miss the tiny disclaimer showing the real URL.

CSS Tricks: Sophisticated phishing emails use CSS to position elements on top of each other, hiding real URLs or displaying deceptive content. For example, a page might display "Verify your Amazon account" while hiding the actual phishing site name underneath.

How Anti-Phishing Tools Work and Their Limitations

Most email providers and browsers include anti-phishing tools that attempt to detect and block phishing emails and sites. Understanding how these tools work and their limitations helps you remain vigilant even when using them.

Email Filtering: Email providers like Gmail, Outlook, and Yahoo use sophisticated algorithms to detect and filter phishing emails before they reach your inbox. These tools analyze sender addresses, links, attachments, and email content to identify common phishing patterns. However, they're not perfect. Some phishing emails bypass filters, and some legitimate emails are incorrectly flagged as phishing.

Browser Warnings: Modern browsers (Chrome, Firefox, Safari, Edge) display warnings when you attempt to navigate to known phishing sites. These warnings are based on databases of known malicious sites maintained by organizations like Google Safe Browsing. However, new phishing sites are created constantly, and it takes time for them to be identified and added to these databases. A newly created phishing site may not trigger a browser warning.

URL Reputation Services: Some email clients and security software check the reputation of links in emails and warn you if a link leads to a known malicious site. However, like browser protection, these services rely on databases of known bad sites. Brand new phishing sites may not be in these databases yet.

Limitations: No anti-phishing tool catches 100% of phishing attempts. Attackers constantly develop new tactics to bypass filters and protections. This is why human judgment—your careful evaluation of emails—remains essential. Don't rely solely on anti-phishing tools. Use them as one layer of defense while remaining vigilant about phishing indicators.

What to Do When You Receive a Phishing Email

If you've received a phishing email, take immediate action to protect yourself and help prevent others from being victimized.

Step 1: Do Not Click Any Links or Download Attachments. Close the email and do not interact with it. If you accidentally clicked a link before realizing it was phishing, see the section below on "What to Do If You Clicked and Entered Information."

Step 2: Report to Your Email Provider. Most email providers have mechanisms to report phishing emails. In Gmail, click the three dots and select "Report phishing." In Outlook, click the "Junk" button and select "Phishing." In Yahoo, click "Spam" then "This is phishing." Reporting helps the email provider improve their filters.

Step 3: Report to the Anti-Phishing Working Group. Forward the phishing email to reportphishing@apwg.org. The APWG is an international organization that works to combat phishing and helps coordinate law enforcement responses. Include the full email header when you forward it.

Step 4: Report to the Impersonated Company. If the phishing email impersonates a specific company (e.g., Amazon, PayPal, your bank), report it to that company's fraud department. Most companies have fraud reporting email addresses or contact forms on their websites. Reporting helps the company warn their customers and may trigger them to take action against the phishing site.

Step 5: Report to Law Enforcement. For significant phishing attacks, report to the FBI's Internet Crime Complaint Center at ic3.gov. Also report to the FTC at reportfraud.ftc.gov.

Step 6: Delete the Email. After reporting it, delete the email. Don't keep it in your inbox where you might accidentally click it later.

What to Do If You Clicked a Phishing Link and Entered Information

If you've already clicked a phishing link and entered information (username, password, credit card number, etc.), take immediate action to minimize the damage:

Step 1: Change Your Password Immediately. If you entered your email password or a password to any account, change it immediately. Use a strong, unique password that you haven't used anywhere else. Do this from a different device if possible, to ensure it's not compromised.

Step 2: Enable Two-Factor Authentication (2FA). If the account you compromised doesn't have 2FA enabled, enable it immediately. 2FA makes it harder for attackers to access your account even if they have your password.

Step 3: Monitor Your Accounts. Check your email account, bank accounts, and any other important accounts for unauthorized activity. Look for password changes, new devices added, forwarding rules, or unauthorized transactions.

Step 4: If You Entered Financial Information. If you entered credit card or bank account information, contact your bank or credit card issuer immediately. Explain that you may have been compromised via phishing. Request that they monitor your accounts for unauthorized transactions and consider issuing a new card.

Step 5: Place a Fraud Alert on Your Credit. If you believe your identity may have been stolen, place a fraud alert on your credit file by contacting one of the three major credit bureaus (Equifax, Experian, or TransUnion). A fraud alert tells potential lenders to verify your identity before extending credit.

Step 6: Run Security Software. Run a full scan with reputable antivirus software to check whether the phishing site installed malware on your device. Malware could allow attackers to monitor your keystrokes or access your files.

Step 7: Report the Phishing. Follow the reporting steps outlined in the previous section.

Email Security Best Practices to Prevent Phishing

While no single practice guarantees immunity from phishing, combining multiple practices creates multiple layers of defense:

• Use Two-Factor Authentication (2FA): Even if a phishing attack compromises your password, 2FA requires a second form of verification (a code from your phone, for example) to access your account. Most phishing attacks aim to get your password; 2FA defeats that goal.
• Use a Separate Email for Sensitive Accounts: Create a dedicated email address for sensitive accounts (banking, investment, cryptocurrency, email recovery). Don't use this email for online shopping, social media, or newsletter signups. This limits the phishing emails this email address receives and reduces the risk of account compromise.
• Use a Password Manager: A password manager stores unique, complex passwords for each account and automatically fills them in on legitimate websites. Phishing sites often can't convince your password manager to auto-fill, because the password manager recognizes that the site isn't the legitimate domain.
• Enable Email Filtering: Configure your email provider's settings to filter emails from suspicious senders. Filter emails with certain keywords common in phishing ("verify your account," "confirm your identity," "unusual activity").
• Be Skeptical of Sender Addresses: Familiarize yourself with the official email addresses your banks and frequent companies use. Treat emails from unfamiliar addresses with suspicion.
• Don't Rely on Display Names Alone: The display name on an email can be spoofed. Always check the actual sender's email address, not just the display name.
• Review Account Activity Regularly: Log into important accounts regularly and review the activity. Most banks and email providers show you a log of logins and device access. If you see unrecognized activity, your account has been compromised.

How Phishing Attacks Lead to Large-Scale Breaches

Individual phishing attacks against employees can result in compromised corporate networks and massive data breaches. A single phishing email to a company employee that successfully captures their credentials can give an attacker access to the entire corporate network. The attacker can then:

• Access confidential files and data
• Install malware on network computers
• Escalate their access to higher-privilege accounts
• Access customer databases containing millions of personal records
• Deploy ransomware that encrypts all company files and demands payment

This is why companies invest heavily in employee training to prevent phishing. A single successful phishing attack can cost a company millions of dollars in breach response, legal liability, and ransom payments. For this reason, if you work at a company, take phishing awareness training seriously and report suspicious emails to your IT department immediately.

Real-World Phishing Examples

Understanding real phishing attempts helps you recognize them in the wild. In one well-documented case, Target employees received phishing emails appearing to come from Target's HVAC vendor. The emails contained a malicious attachment. An employee opened the attachment, which installed malware on their computer. The malware gave attackers access to Target's network, which they used to access payment card data for over 40 million Target customers. This breach cost Target over $18 million in direct damages.

In another case, Google employees received phishing emails that appeared to come from HR asking them to update their credentials. Employees who entered their information had their accounts compromised. Attackers used the compromised employee accounts to access internal Google systems and attempt to exfiltrate source code. This highlighted that even employees of technology companies are vulnerable to sophisticated phishing.

Key Takeaways: Protecting Yourself from Phishing

Phishing emails are the most common entry point for fraud, identity theft, and malware. Protect yourself by:

• Learning to recognize phishing indicators: spoofed addresses, urgency language, generic greetings, suspicious links, requests for sensitive information.
• Hovering over links before clicking to verify they lead to legitimate websites.
• Inspecting email headers to confirm the actual sender address.
• Never entering sensitive information in response to email requests.
• Using two-factor authentication on all important accounts.
• Reporting phishing emails to your email provider, the APWG, and the impersonated company.
• If you've been compromised, change passwords immediately and monitor your accounts.

Related Scam Checkers

Other Scams to Watch For

People researching this scam also check these related pages.

Identity Theft Scam

Detect identity theft attempts and personal information fraud.

Check Now

Impersonation Scam

Identify scammers impersonating officials, brands, and loved ones.

Check Now

Fake Banking App

Spot fraudulent banking apps designed to steal login credentials.

Check Now

Fake Bank Texts

Detect fake bank text messages designed to steal your credentials.

Check Now

Fake Bank Text Message

Recognize fraudulent bank text alerts and smishing fraud.

Check Now

Bank Account Phishing

Recognize phishing attacks targeting your bank login credentials.

Check Now

Credit Card Phishing

Detect fake credit card alert emails and card detail theft.

Check Now

Amazon Scam

Detect fake Amazon order confirmations, Prime renewal scams, and phishing emails.

Check Now