A phishing email is a fake message that pretends to come from a company, a bank, or a person you trust. Its only goal is to get you to click a link, open an attachment, or hand over personal details. If you learn the red flags below, you can spot most phishing emails in under a minute, before any damage is done.
What Phishing Looks Like in 2026
Phishing is no longer full of obvious spelling mistakes. Modern scam emails copy real logos, real layouts, and real wording from banks, delivery firms, and streaming services. Some even address you by name, because the sender bought or stole your details in an earlier data breach. The message usually asks you to act on an account problem, a payment problem, or a delivery problem. That problem is always fake, and the link always leads somewhere the real company would never send you.
Phishing is the email version of the scam. Smishing is the same trick by text message, and vishing is the same trick by phone call. The red flags in this guide work for all three, because the tactics are the same even when the channel changes.
The Sender: What to Check First
Start with the sender, not the message. A spoofed sender address is the single most common giveaway. The display name may read “Royal Mail” or “PayPal”, but the real address behind it can be completely different. On a phone, tap the sender name to reveal the full address before you trust it.
Watch for lookalike domains. Scammers register addresses such as royalmail-support.com, paypa1.com, or hsbc-secure.net. The brand name is there, but the domain is not the real one. A genuine company will email you from its own domain, and it will never use a free webmail address for account or payment messages.
Also check the tone. A real company already knows your account details, so it will not email you out of the blue asking you to confirm your full password, your card number, or a one-time code. Any message that asks for those details is a scam, even if the logo looks perfect.
Links and Attachments: the Two-Second Tests
Never click a link in a suspicious email to find out where it goes. On a computer, hover over the link first and read the address shown at the bottom of the browser. On a phone, press and hold the link to preview it without opening it. If the address does not match the company named in the email, do not tap it.
Shortened links deserve extra care, because they hide the real destination completely. The same applies to buttons labelled “Verify now” or “Update details”. A button can point anywhere, so the label tells you nothing about the destination.
Treat unexpected attachments the same way. A real delivery firm will not send you an invoice as a zip file, and a real bank will not ask you to open a document to unlock your account. If you were not expecting an attachment, do not open it. Delete the message instead, and contact the company through its official website or app if you are unsure.
The Urgency Trick and How It Works
Almost every phishing email uses urgency. “Your account will be closed in 24 hours.” “Your parcel will be returned today.” “Unusual activity detected, act now.” The pressure is deliberate. It is designed to stop you checking the sender address or hovering over the link, because a calm reader spots the scam.
The defence is simple: slow down. No genuine company will close your account or cancel your delivery because you took ten minutes to check. Open the company’s own app or type its real website address yourself, and check your account there. If there is a real problem, it will show up in your real account. If there is nothing there, the email was fake.
Parcel and Delivery Scams in the UK
Parcel scams are now among the most common phishing messages in the UK. You get a text or email claiming a missed delivery, an unpaid fee, or a parcel held at a depot. The message includes a link to reschedule delivery or pay a small charge. That link leads to a fake page that steals your card details.
Real UK delivery firms do not ask you to pay a redelivery fee through a link in a text message. If you are expecting a parcel, track it through the retailer’s website or the courier’s official app, using the tracking number from your order confirmation. If you are not expecting a parcel at all, the message is almost certainly a scam.
You Clicked: What to Do Next
If you clicked a phishing link, act quickly and stay calm. Close the page at once and do not enter any details. If you did enter a password, change that password straight away, and change it anywhere else you used the same one. Our guide to creating a memorable secure password will help you pick a stronger replacement.
If you entered card details, contact your bank immediately and ask them to block the card. If you think your email account itself may be compromised, read our guide on how to tell if your email was hacked. If a social media account was taken over through the scam, see our guide to recover a hacked Instagram account for the recovery steps.
Finally, run a malware scan on your device if you opened an attachment. Most modern antivirus tools will catch anything the attachment tried to install, but a full scan is worth the few minutes it takes.
Where to Report It: 7726 and Action Fraud
Reporting phishing helps shut the scam down for everyone else. In the UK, forward suspicious emails to report@phishing.gov.uk. For scam text messages, forward the message free of charge to 7726, which spells SPAM on a phone keypad. Your mobile network uses these reports to block the sender.
If you lost money or shared sensitive details, report it to Action Fraud, the UK national fraud reporting centre, on 0300 123 2040 or through its website. Keep the original message if you can, including the sender address and any links, because investigators use those details to trace the scam.
FAQs
How do I know if an email is a scam?
Check the sender address first, then hover over any link without clicking it. A mismatched domain, a request for passwords or card details, or a threat that your account will close today are all strong signs of a scam.
What is smishing?
Smishing is phishing by text message. It uses the same tricks as email phishing, usually a fake delivery notice or a fake bank alert, and the same defence applies: do not tap the link, and check your account through the official app instead.
What should I do if I clicked a phishing link?
Close the page and change any password you entered. If you entered card details, contact your bank at once. Then report the message to report@phishing.gov.uk, or forward a scam text to 7726.
Can a phishing email infect my device just by opening it?
Simply opening a plain email is very unlikely to infect your device. The danger comes from clicking links and opening attachments, which is why those two actions deserve the checks in this guide.
Does reporting a phishing email actually help?
Yes. Reports to 7726 and report@phishing.gov.uk help networks and email providers block the sender and take down fake websites, which protects other people from the same scam.
Conclusion
Phishing works by rushing you. Check the sender, preview every link, and ignore any message that demands an instant response. When in doubt, go to the company directly through its own app or website instead of following a link. Those three habits will stop almost every phishing email before it costs you anything.
