Is This Email a Scam? 7 Phishing Red Flags

Instant check · $2, one-time

Check the email's link right now

Don't click the link — copy it (right-click or long-press → copy link) and paste it here. Free risk signal in seconds; the full 0–100 report with evidence is $2, one time.

The full checklist

The 7 red flags of a phishing email

Phishing emails are impersonations with a deadline: a bank, a delivery company, a tech giant, the IRS — whoever will scare you into clicking fastest. The costumes change weekly; the tells underneath don't. These are the seven.

Check a link — $2

01

Manufactured urgency

Your account closes in 24 hours. The package returns to sender today. Unusual sign-in detected — verify now. The deadline exists to outrun your judgment. Real companies don't give you hours to comply.

02

A sender address in costume

Don't read the display name — read the address. A bank writing from Gmail, one letter swapped, a string of hyphens and random words. Expand the full sender field; the costume only works if you don't look.

03

They don't know your name

“Dear customer.” “Dear user.” “Hello, account holder.” Your bank knows your name — a mass-mailed scam doesn't. A generic greeting on a message about your specific account is a tell.

04

The link lies

Hover over it (or long-press on a phone) before you ever click: the text says one company, the real destination is somewhere else entirely. Misspelled domains, strange subdomains, and link shorteners are the uniform.

05

An attachment or QR code you didn't ask for

“Invoice attached.” “Scan to reschedule delivery.” Attachments carry malware, and QR codes hide the destination from both you and your email filter. Neither belongs in a surprise email.

06

A request no real company makes

Your password, your full card number, your Social Security number — “to verify your account.” Legitimate companies never ask for these by email. The request itself is the scam, no matter how real the page looks.

07

It almost fits your life

You did just order something. You do use that bank. That's not proof — it's coincidence at mass scale, or your address was in a leaked list. Verify through the official app or a URL you type yourself, never the email's link.

What to do now

Think this email is phishing? Do this now

1

Don't click, don't reply, don't download

Close it. If you already clicked but entered nothing, you're almost certainly fine — just close the tab. Never reply to “confirm” details; a reply tells them your address is live.

2

Verify on the official channel

Open the company's app, or type their real web address yourself, and check whether the claimed problem exists. If the email gave a phone number, don't call it — find the real number on your card or statement.

3

Check the link, then report it

Copy the link (don't click) and run it through Scam Detective for a 0–100 risk score, then report the email as phishing to your provider and at ReportFraud.ftc.gov before you delete it.

Questions

Asked by people in your exact spot

I clicked the link before I checked. What now?

If you only clicked and entered nothing, you're very likely fine — close the tab and move on. If the page downloaded a file or asked you to sign in, act: run an antivirus scan, and if you typed a password, change it immediately on the real site — and everywhere else you reused it.

I entered my password or card number on the page.

Change that password now — on the real site, reached by typing the address yourself — and on every account that shares it. Turn on two-factor authentication. If you typed a card number, call your bank, report it compromised, and ask for a new card. Speed beats regret.

The email has the company's real logo and layout. Doesn't that count?

No — logos and email templates are images, copied in seconds. Phishing emails routinely look pixel-perfect because the design is stolen. Judge the sender's actual address, the link's real destination, and what the message asks you to do.

Can you check a link from an email or text?

Yes — copy the link without clicking it (right-click or long-press → copy link), and paste it into the checker above. The free signal takes seconds; the $2 full report weighs domain age, impersonation signals, phishing markers, and payment red flags, with evidence.

Checking something else?