Phishing Email Red Flags Everyone Should Know in 2026

Phishing endures because it attacks the one component that never gets a security patch: human judgment. The messages have gotten cleaner over the years — better grammar, real logos, and increasingly, fluent text generated by AI — so the old advice of "look for typos" no longer cuts it. What still works is knowing the structural red flags that phishing can't easily hide, and having a fixed routine for suspicious mail.

Red flag 1: The sender address doesn't match the story

The display name on an email is free text — anyone can send mail displaying "PayPal Support" or your boss's name. The actual address behind it is harder to fake convincingly. Expand the sender details on any message asking you to act, and check:

• The domain after the @. Mail claiming to be your bank should come from your bank's exact domain, not a lookalike, not a free mail provider.
• Lookalike tricks. Swapped letters, added words, and wrong endings: secure-yourbank-login.com is not yourbank.com. The real domain is the last two segments before the first slash in a URL — everything to the left can be decoration.
• Reply-to mismatches. A legitimate sender rarely needs replies routed to a completely different domain.

Red flag 2: Manufactured urgency

"Your account will be suspended in 24 hours." "Unusual sign-in detected — verify immediately." "Final notice." Urgency is the engine of phishing, because rushed people skip verification. Real institutions almost never demand instant action through an email link, and anything genuinely urgent will also be visible when you log in to the service directly.

The moment an email makes you feel a clock ticking, treat that feeling itself as the red flag.

Red flag 3: The link goes somewhere the text doesn't say

Phishing lives and dies by the link. Before clicking anything in an unexpected email:

• Hover (or long-press on mobile) to preview the real destination.
• Distrust shortened URLs in messages claiming to be from institutions.
• Watch for legitimate-looking paths on wrong domains — the words "login" and your bank's name appearing somewhere in a URL mean nothing.

The safest habit costs five seconds: don't click the email link at all. Open your browser and type the service's address yourself, or use your bookmark. If the alert was real, it will be waiting in your account.

Red flag 4: A request for credentials, codes, or payment

Step back from the details and look at what the email actually wants. The endgame of nearly all phishing is one of:

• Your password, entered on a fake login page
• A two-factor or verification code, relayed in real time to an attacker logging in as you
• A payment or gift card purchase, usually with a story about invoices or an executive in a hurry
• An attachment opened, delivering malware

No legitimate service asks you to confirm your password by email, and no one legitimate ever needs the security code that was just texted to you. If credentials have already been entered somewhere sketchy, change that password immediately and run it through our password leak check — and if it was reused elsewhere, change it there too, ideally replacing it with output from a password generator.

Red flag 5: Context that doesn't add up

• A delivery notice when you're not expecting a package
• An invoice from a company you've never dealt with
• A "shared document" from a contact who never shares documents
• A prize, refund, or inheritance you never pursued

Phishers send at massive scale precisely because they don't know your context. You do. An email that's plausible in general but wrong for you specifically is one of the most reliable tells there is.

Why phishers have your address at all

Your address ends up in phishing target lists mostly through data breaches and harvested marketing databases — mechanisms we break down in our look at why spam keeps winning. Two habits shrink your exposure:

1. Check where you already stand. Run your address through our breach check to see if it appears in known leaked datasets. A breached address will be phished; expect it and be ready.
2. Stop feeding new lists. Every low-stakes signup made with your real address is a future phishing vector. Route disposable signups through a temporary inbox instead — a MailDrop address expires on its own, so lists that harvest it end up mailing a void.

A 30-second routine for any suspicious email

1. Don't click, don't reply, don't open attachments. Nothing in a suspicious email is safe to interact with, including the unsubscribe link.
2. Check the real sender domain. Not the display name.
3. Ask what it wants. Credentials, codes, money, or an attachment opened? Assume phishing.
4. Verify out-of-band. Go to the site directly or use a known phone number — never the contact details in the email.
5. Report and delete. Use your mail provider's report button; it improves filtering for everyone.

The bottom line

You don't need to out-analyze every scam. You need a small set of reflexes: sender domain over display name, typed URLs over emailed links, suspicion of urgency, and absolute refusal to hand over passwords or codes through email. Build those habits — and keep your real address out of circulation using the compartmentalization approach in our online privacy checklist — and the overwhelming majority of phishing attempts will simply bounce off you.