How to spot a phishing email before you click

Six signs of a phishing email

1. It is urgent. “Your account will be closed today.” “Act now to avoid a penalty.” A false sense of urgency is the most common trick, because it stops you from thinking it over or asking someone.
2. It asks for personal or payment details. The FTC notes that legitimate companies won't email or text you a link to update your payment information.
3. The sender's address is off. The name says your bank, but the address ends in something else, or the company name is misspelled by one letter.
4. The link goes somewhere else. Rest your mouse pointer on the link without clicking. The real address appears. If it doesn't match the company, don't click.
5. The greeting is generic. “Dear customer” from a company that knows your name is a warning sign.
6. There is an attachment you didn't expect. An invoice you don't recognize, a “shipping label”, a “voicemail”.

Bad spelling used to be a reliable sign. It is less reliable now: scam emails can be written perfectly, so look for the other signs too.

What to do with a suspicious message

1. Don't click links or open attachments, and don't call any number in the message.
2. Ask yourself: do I have an account with this company, or know this person? If not, it is probably phishing.
3. If it might be real, check another way. Go to the company's website by typing its address yourself, or call a number you already know is real. If it seems to be from a friend, call or text them.
4. Report it. Most email programs have a “Report phishing” or “Report spam” button.
5. Delete it. Don't reply, and don't click “unsubscribe” in a message you don't trust.

If you already clicked

• Typed a password? Change that password now, and anywhere else you use the same one. Then turn on two-step verification.
• Opened an attachment or downloaded something? Update your security software and run a scan. See how to scan with Windows Security.
• Gave a card, bank or Social Security number? Go to IdentityTheft.gov, the FTC's site, for the steps that fit what was taken.

Four habits that protect you

The FTC recommends four: use security software and let it update automatically, keep your phone's software updating automatically, protect your accounts with multi-factor authentication, and back up your data.