How to Spot Phishing Emails Easily: 7 Practical Steps for a Safer Inbox

Okay so here’s the thing. Yesterday I was having a lazy coffee break, scrolling through my inbox, when an email from “my bank” popped up saying my account was about to be frozen. Right. No weird transactions on my end at all. I opened up the sender details and — you guessed it — the address turned out to be bank-keep-me-safe@gmail.com. I honestly didn’t know whether to laugh or just roll my eyes.

But here’s what got me thinking after that: what happens when an email like that lands in a non-technical client’s inbox? Or worse — in the inbox of the accounting staff who handles invoices and payments? Yeah, that’s a recipe for disaster. That’s why I felt like I had to write this guide on how to spot phishing emails easily. Don’t worry, no fancy tools needed. You just need to pay attention to the small details.

Why Phishing Emails Are a Bigger Deal Than You Think

Before we get into the steps, let’s talk about why this actually matters. Phishing isn’t just a spam email you delete and forget about. It’s one of the cheapest and most effective forms of social engineering out there. An attacker only needs one person to fall for it out of a thousand emails sent, and they’ve made their money back. And the damage isn’t just “my account got hacked” — it goes all the way up to leaked client data, a compromised mail server, or a company wire transfer that ends up in the wrong account. I once saw a client open an “invoice” attachment just to check their bill. Long story short: their whole mail server had to be restored from backup. It was exhausting.

What makes it worse is that phishing emails keep getting smarter. Back in the day you could spot them easily — broken English, clunky layouts that looked like they were built in 2005. These days attackers use layouts that look almost identical to the real thing, domains that look right at a glance, and sometimes they even use the actual logo of your bank or provider. So please, never think “oh, I’d never fall for that.” That’s exactly the mindset attackers are counting on.

So how do you tell them apart? Don’t worry, there’s a way. Below are seven easy ways to spot phishing emails that I use every single day — whether I’m checking mailboxes on a server or explaining to a client whether an email is legit. Everything here is cheap, requires no weird software, and you can start using it right now. Just read through it and try them one by one. Your inbox will thank you.

7 Easy Ways to Spot Phishing Emails

1. Check the Sender Address, Not Just the Display Name

Ever seen an email from “Sejahtera Bank” that, when you look closer, actually comes from rekening-pt-bank@gmail.com? That’s the first point. The display name is incredibly easy to fake — anyone can type whatever name they want in their mail client settings. The thing you can’t fake easily is the actual email address. So the number one habit you need to build: always look at the email address, not just the name on screen.

It’s simple to do. In Gmail, click on the sender’s name and the full address shows up. In Outlook Desktop, double-click the sender in the message list. In Thunderbird, just hover. It sounds trivial, but this single step filters out something like 70 percent of the phishing emails coming in. Seriously, that many. Most phishers are too lazy to set up their own domain — they just use free Gmail or Yahoo accounts.

2. Examine the Sender Domain, Character by Character

This is the follow-up to the previous point, and it’s where you need to pay real attention. Modern phishers are great at building lookalike domains. Like banksejahtera-id.com when the real one is banksejahtera.co.id. Or bpjs-kes.com when the real one is bpjs-kesehatan.go.id. A single dash or a single letter difference is enough to catch victims.

There’s also a trick that made me pause the first time I saw it: the lowercase l and the number 1, or the letter o and the number 0. In certain fonts they look exactly the same. Example: g00gle.com vs google.com. So if the domain looks odd but familiar, don’t rush to trust it. Copy the domain, paste it into a text editor, and read it letter by letter. And if an email claims to be from a bank but is sent from a free Gmail account? Yeah, stop reading right there.

3. Hover Before You Click

This is the habit I push the hardest on my team: DON’T click links straight from an email. Hover your cursor over the link or button first, and look at the real URL in the bottom-left corner of your browser. It works in Gmail and Outlook. On mobile, press and hold the link and a URL preview will pop up.

What should set off alarm bells: a URL that uses a raw IP address (like http://45.33.12.9/login), a URL whose domain has nothing to do with the sender, or a link hidden behind a URL shortener like bit.ly. Any of those is a red-level warning. And remember — the text on a button can point anywhere. A button that says “Click to verify” can happily send you to a malicious site.

4. Be Careful With Attachments

Attachments are probably the most dangerous tool in a phishing email. The most common ones are PDF, DOCX, and ZIP. Why? Because a lot of people think PDFs are safe, when in fact a PDF can contain a malicious link or an exploit. ZIP files are even worse — they usually sit there waiting to be extracted and executed.

What looks suspicious: a file name that’s oddly generic but suddenly relevant, like Invoice_2026.zip or Payslip.pdf, sent by someone who never sends you documents. If you weren’t expecting a document from that person, don’t open it. If you really have to open it for work, at least scan it with VirusTotal or your local antivirus first.

5. Check SPF, DKIM, and DMARC in the Email Header

This is my favorite part, because it’s the most technically accurate. Any domain that’s properly managed usually has SPF, DKIM, and DMARC records configured in DNS. When an email is sent, the receiving mail server checks: does the sending IP have permission to send on behalf of that domain (SPF), is the message signed with the right key (DKIM), and what should happen if both fail (DMARC).

The results live in the email header, usually in the Authentication-Results field. If you see SPF: FAIL, DKIM: FAIL, DMARC: FAIL, it’s almost certainly phishing. If everything passes, there’s still a chance a legit account got hijacked, but at least fake emails from dodgy domains get caught immediately. How you view the header differs per mail client — I go into detail in this SPF DKIM DMARC guide I wrote earlier. The short version: it’s the strongest layer of protection you have.

And a bonus tip for anyone running servers: if your own domain doesn’t have SPF, DKIM, or DMARC yet, set them up now. Without all three, your domain is an easy target for spoofing, and someone will use it to phish your customers. I’ve covered the full setup there too — just follow along.

6. Be Wary of Urgency and Threats

Pay attention to the emotional pattern. Phishing emails almost always push you into a panic state: “Your account will be closed within 24 hours”, “Transaction failed, verify now”, “Your invoice is overdue, penalty applies”. The goal is a single thing: get you to act before you think.

Real emails are rarely that urgent. And when there is a real problem, there’s always another way to verify: the official app, a call center, or walking into a branch. If the only way to “save your account” is clicking a link in the email, that’s a phishing sign. Never verify sensitive data over email, no matter the story.

7. Use Helper Tools When You’re Still Not Sure

If all the manual checks above still leave you unsure, it’s time to bring in backup. Upload the attachment to VirusTotal to check for malware. For suspicious links, URLScan.io and VirusTotal can both scan the URL. For checking the reputation of a domain or a sending IP, MxToolbox works well. No need to upload sensitive data — just the attachment itself.

Just remember: tools are only helpers. They can tell you “this file has a virus” or not, but they can’t tell you “this message really came from the person who claims to have sent it”. For that, you go back to method five, or you simply call the person or organization directly. And if you manage servers, it’s worth reading the email server hardening guide so your own domain doesn’t become a phishing vehicle for your customers. Keep an eye on your mail logs too — I wrote a piece on server log monitoring that covers exactly that.

Quick Reference: Signs That Show Up in Phishing Emails

FAQ About Detecting Phishing Emails

Alright, that’s it for this one. The main thing is to build the habit of checking the sender and hovering before you click. If you’ve ever fallen for an oddly convincing phishing email, drop it in the comments — I’m genuinely curious about the latest patterns out there. Thanks for reading!