How Do You Spot and Stop Phishing Emails?

Quick Answer

The fastest way to spot a phishing email is to check three things before you click anything: the full sender address (not just the display name), the real destination of any link (hover over it without clicking), and the emotional tone (real companies almost never threaten you with account suspension in two hours).

To stop phishing at scale, make sure your domain has SPF, DKIM, and DMARC records configured, turn on phishing protection in your email client, and enable hardware key or passkey based multi factor authentication on every important account. Those four steps block the overwhelming majority of real world attacks.

The Three Visual Red Flags

Modern phishing has moved past the "Dear customer, pls click here" stereotype. Attackers now use real logos, scraped employee directories, and AI generated copy that reads almost professional. But the structural giveaways are still there if you slow down for ten seconds.

• Mismatched sender domain. "Microsoft Support" might be the display name, but the actual sender is support@micros0ft-helpdesk.co. Open the full header and look at what is after the @.
• Manufactured urgency. "Your account will be deleted in 24 hours." "Unauthorized login detected, verify now." Real banks, governments, and IT teams do not work on those timelines.
• Generic salutation. "Dear valued customer" or "Hello user" instead of your actual name is a strong signal of a mass blast. Your real bank knows your name.

The Link Hover Check

Every link in HTML email has two parts: the visible text and the underlying URL. Attackers exploit this gap constantly. The button might say "Verify Your Password," but the destination might be http://security-update-login.tk/harvest.

On desktop, hover your mouse over the link without clicking. Your email client (Gmail, Outlook, Apple Mail) shows the real destination in the corner of the window. On mobile, press and hold the link until a preview pops up. Look closely for:

• Look alike domains. arnazon.com uses "rn" to mimic "m." paypa1.com swaps "l" for "1."
• Subdomain trickery. chase.com.security-login.net is the domain security-login.net, not Chase.
• URL shorteners. bit.ly, tinyurl.com, and similar are red flags in transactional email. Legitimate banks never use them.

The Attack Profiles to Know

Not every phishing campaign is mass mailed. The major categories worth recognizing:

• Bulk phishing. Fake banking alerts, package delivery notices, streaming service password resets. Cast a wide net for any credentials they can grab.
• Spear phishing. Targeted at a specific employee, often referencing real internal projects scraped from LinkedIn or press releases.
• Whaling. Targets a C suite executive. Common pattern: a fake email from "the CEO" to the CFO asking for an urgent wire transfer.
• Business email compromise (BEC). Attacker takes over a real internal mailbox (usually via earlier phishing) then sends fraudulent invoices from a trusted address.

BEC is now the most expensive category of cybercrime by total dollar loss, according to FBI annual IC3 reports. The mitigation is almost always procedural: any wire transfer or banking detail change must be verified by phone using a number you already had, not a number from the email.

SPF, DKIM, and DMARC: Server Side Defense

The best anti phishing layer is the one that stops fakes from reaching the inbox in the first place. Three DNS records do most of the work:

1. SPF (Sender Policy Framework). A DNS record that lists which IP addresses are authorized to send mail from your domain. Receivers reject anything else.
2. DKIM (DomainKeys Identified Mail). Adds a cryptographic signature to every outgoing message. Receivers verify the signature against your published public key.
3. DMARC. Tells receiving servers what to do when SPF or DKIM fail: monitor, quarantine, or reject outright. A DMARC policy of p=reject is the gold standard for any domain that sends real email.

If you run a business domain, configuring DMARC at p=reject is the single highest leverage anti phishing move available. It stops attackers from convincingly spoofing your domain to your own customers.

Personal Hardening: Passkeys and Hardware Keys

Even if you click a phishing link, you can prevent the credential from being useful. The fix is to move away from passwords entirely:

• Passkeys. Built into iOS, Android, macOS, and Windows. Cryptographic credentials that cannot be phished because they only work on the real domain they were registered against.
• Hardware security keys (YubiKey, Titan). Same anti phishing property, USB or NFC form factor, ideal for high value accounts (email, banking, password manager, work SSO).
• App based TOTP. Better than SMS but still phishable if the attacker proxies your login in real time. Use only when passkeys or hardware keys are not supported.

SMS based codes are the weakest factor and should not be used on accounts you care about.

What to Do If You Already Clicked

If you clicked a link or entered a credential into a phishing page, act in this order: change the password on the affected account immediately from a known good device, sign out of all active sessions, enable a stronger MFA factor if it was not already on, and check for any new forwarding rules or third party app authorizations the attacker may have added. Then report the email to your IT team and forward it to reportphishing@apwg.org so it can be added to industry block lists.

The Takeaway

Phishing in 2026 is more polished than ever, but the defenses are also better. Check the full sender address, hover any link before you click, and stay suspicious of any message that manufactures urgency. On the back end, configure SPF, DKIM, and DMARC at p=reject for any domain you own, and move every important personal account onto passkeys or hardware keys. The combination of a slow ten second sanity check and modern phishing resistant authentication blocks the vast majority of real attacks before they cause damage.