1. Is the email unexpected?
Phishing often pretends to be about something urgent that you didn’t actually start:
- “We noticed suspicious activity on your account.”
- “Your package couldn’t be delivered.”
- “Invoice attached – payment overdue.”
If you didn’t initiate a password change, purchase, invoice, or support ticket, treat the email as suspicious by default.
2. Check the real sender address, not just the display name
Attackers love display names like “PayPal Support” or “IT Helpdesk”, but the actual email address might be something like:
Hover or tap to see the full address. If the domain after the @ doesn’t match the real company website, big red flag.
3. Look for urgency and fear language
A lot of phishing plays on panic:
- “Final warning”
- “Your account will be closed within 24 hours”
- “Immediate action required”
Real companies might send serious messages, but they rarely force you to click a link in one random email under a tight countdown.
4. Be suspicious of links and buttons
Before you click, hover over the link or button and check where it really goes:
- Does the domain match the official website exactly (spelling, dots, everything)?
- Is there a weird extra domain in front (like “secure‑something‑paypal.com”)?
- Does it go through a strange tracking/redirect domain you don’t recognise?
A safer move is to ignore the link and go to the site directly by typing the address into your browser or using a saved bookmark.
Later, this could host a small security‑related ad or link to training content.
5. Attachments you weren’t expecting = danger
Files attached out of nowhere are a common way to deliver malware, especially:
- .zip archives
- .html files that ask you to log in
- .exe or .bat executables
- “Invoices” or “scans” you weren’t expecting, even as PDFs
If you weren’t expecting an attachment, don’t open it. Confirm through another channel first.
6. The email just “feels off”
Many phishing campaigns get caught on vibe checks:
- Odd grammar or phrasing compared to usual emails from that company.
- Generic greeting instead of your real name.
- Strange logo, formatting, or colours.
None of these prove it’s fake on their own, but stacked together they’re a warning sign.
7. Use the “Is this email sketchy?” checklist as a second brain
When you’re tired or stressed, it’s easy to miss things. The Is this email sketchy? helper:
- Lets you paste the sender, subject, and main text.
- Gives you a checklist of common red flags to tick through.
- Returns a rough “low / medium / high risk” band with reminders on what to do next.
It doesn’t send your text anywhere — it just runs in your browser and helps you slow down before reacting.
8. What to do if you already clicked
If you clicked a suspicious link or entered your password:
- Change the password immediately on the real site (and anywhere else you reused it).
- Turn on two‑factor authentication if the account supports it.
- Tell your IT/security team if this is a work account.
- Keep an eye on account activity and financial statements.
This page and the helper tool are not magic detectors or security guarantees. They’re just there to help you think through obvious red flags. Always follow your organisation’s security policy and use official contact channels when you’re unsure.