Phishing Email Checklist: How to Spot a Scam

Everyone · Checklist · Updated October 1, 2026 · LearnLife Editorial

When should you use a phishing email checklist?

You should use a phishing email checklist any time you receive an email that feels suspicious, unexpected, or asks for sensitive information like passwords, financial details, or personal data. For example, if you get an email saying your bank account will be locked unless you verify your information immediately, that’s a perfect time to apply the checklist. Email scams often disguise themselves as urgent requests, so if an email pressures you to act quickly or threatens negative consequences, pause and run through the checklist before responding. Also, use it when the sender is unfamiliar or when the email includes attachments or links you didn’t expect. Making this a habit helps prevent falling victim to scams that can lead to identity theft or financial loss. Even if an email appears to come from a trusted source, scammers can spoof email addresses, so the checklist applies broadly. Using it regularly builds your awareness and protects your digital safety.

What initial sender checks should you perform?

Start by examining the sender’s email address carefully rather than just the display name. Often, scammers use email addresses that look similar to legitimate ones but have subtle differences. For example, an email from “[email protected]” instead of “[email protected]” is suspicious. Look for misspellings, extra characters, or unusual domains such as “.net” or “.org” when the official site uses “.com.” If you see a free email service like Gmail or Yahoo used for a supposed official message, that’s a red flag—official institutions rarely use free services for important notices. If you know how, check the email’s full header to see the actual sending server, which can reveal if the source is legitimate or spoofed. When unsure, search online for the organization’s official contact information and compare it to the email’s details. This initial step weeds out many scam emails masquerading as trusted senders.

How do you review the email content for signs of phishing?

Look carefully at the email’s language and message for common phishing tactics. Many phishing emails try to create urgency, such as “Your account will be suspended in 24 hours!” or “Immediate action required!” This pressure aims to make you act without thinking. Also, pay attention to grammar and spelling mistakes—official emails from legitimate organizations usually have professional editing. For example, “Your acccount has benn compromised” is a classic sign of a scam. Generic greetings like “Dear Customer” or no greeting at all can indicate phishing, as legitimate companies often address you by name. Check what the email asks for; requests to provide passwords, Social Security numbers, or bank account details via email are almost always suspicious. Lastly, be wary of offers that sound too good to be true, like winning a prize or receiving unexpected money. These tactics manipulate your emotions to trick you into responding.

What should you do with links and attachments?

Never click links or open attachments in suspicious emails before thorough checks. To verify a link, hover your mouse over it (on a computer) without clicking to see the actual URL. If the URL looks strange, misspelled, or uses a different domain than expected, do not click it. For example, a link claiming to be from “paypal.com” but actually leading to “paypa1.com” is unsafe. Avoid clicking on shortened URLs (like bit.ly) unless you can verify them independently. For attachments, be cautious if the file type is unusual or executable (.exe, .scr, .bat), as these can install malware. Even common file formats like PDFs or Word documents can contain harmful macros, so only open attachments from trusted sources. When in doubt, access the company’s website by typing the URL directly into your browser rather than clicking email links. Using antivirus software to scan attachments before opening adds an extra layer of safety.

What common red flags do people often skip?

Some red flags are easy to overlook but crucial to catch. One is inconsistent branding, such as logos that are blurry, colors that don’t match the company’s style, or incorrect fonts. For example, a fake email from a delivery company might use a low-quality logo or misspell the company name. Another frequently skipped step is verifying official contact information included in the email; scammers may provide fake phone numbers or addresses. Also, be wary of emails requesting payment via unusual methods like gift cards or wire transfers—legitimate companies rarely ask for these. Many people do not check the unsubscribe link; phishing emails sometimes use fake unsubscribe buttons to confirm your email address is active. Skipping these checks increases the chance a scam email will slip through. Always take time to verify these details to strengthen your defense against phishing.

How can you keep your phishing detection checklist up to date?

Phishing tactics continuously evolve, so regularly updating your checklist is essential. Follow trusted cybersecurity sources like CISA, FTC, or the FBI’s Internet Crime Complaint Center for alerts about new scams. For example, recent scams might involve fake COVID-19 vaccine updates or tax refund messages. Add new red flags or suspicious patterns you learn about to your checklist. Educate yourself on emerging phishing types like “vishing” (phone calls) or “smishing” (text messages), as scammers often use multiple channels. Keep your software and email filters updated to block known phishing threats automatically. Consider scheduling quarterly reviews of your checklist and training family members or coworkers on phishing awareness. Staying informed and proactive helps maintain strong protection against scams.

What practical steps should you take if you suspect phishing?

If you suspect an email is phishing, do not reply or click any links or attachments. Instead, report the email to your email provider’s spam or phishing reporting option. You can also forward the suspicious email to agencies such as the FTC or the FBI’s IC3 for investigation. After reporting, delete the email from your inbox and trash folder to avoid accidental clicks later. If you already clicked a link or provided information, immediately change your passwords for the affected accounts and monitor bank and credit card statements for unusual activity. Consider running a full antivirus scan on your device. Inform your workplace IT department if the email came to your work account. Sharing your experience with friends and family raises their awareness, helping prevent further scams.

Checklist summary: key steps to spot phishing emails

Refer to this checklist every time you receive an email that raises questions, and use it as a foundation for safe email habits.

Frequently asked questions

Can I trust emails that look like they come from my bank?

Even if an email appears to be from your bank, verify the sender’s address carefully and avoid clicking links inside the message. Instead, go directly to your bank’s website by typing the URL or call official customer service numbers. Scammers can spoof bank emails to steal login credentials or personal data.

What should I do if I accidentally clicked a phishing link?

Disconnect from the internet and run a full antivirus scan immediately. Change any passwords related to the compromised account. Monitor your financial statements for suspicious transactions and report the incident to your bank and relevant authorities. Quick action helps limit potential damage.

How can I recognize a phishing email on my phone?

Use the same checklist as on a computer: verify the sender, watch for urgent or suspicious requests, and check links by tapping and holding them to preview the URL without opening. Mobile email apps often show less information, so be extra cautious before clicking or downloading attachments.

Are phishing emails always easy to spot?

No, some phishing emails are very well-crafted and closely mimic legitimate messages. That’s why using a checklist and verifying any questionable email through official channels before taking action is critical. When in doubt, do not respond or click anything.

Can spam filters catch all phishing emails?

Spam filters catch many phishing attempts but cannot catch every one, especially new or targeted scams. Personal vigilance and using a phishing email checklist are essential parts of protecting yourself beyond relying on filters.