How to Spot a Phishing Email in Under 30 Seconds

Phishing emails no longer come with broken English and cartoon logos. Many look exactly like the real thing. The good news: they still leave fingerprints, if you know where to look.

Most people judge an email by how it looks. Attackers know this and copy logos, signatures and formatting perfectly. The trick is to stop judging the design and start checking the details that are hard to fake.

The 30-second check

Five places to look before you click

• The real sender address: Tap or hover on the display name. “Microsoft Support” sending from a random Gmail account or a misspelled domain like micros0ft-support.com is a giveaway.
• The link destination: Hover over buttons and links. If the web address does not match the company it claims to be from, stop.
• The pressure: Threats of account closure, missed deliveries, overdue invoices or legal action within hours are designed to make you skip thinking.
• The request: Log in, open an attachment, buy gift cards, change bank details, approve a sign-in. Any of these deserves extra scrutiny.
• The context: Were you expecting it? Does the sender usually write like this, at this time, about this topic?

A convincing logo proves nothing. Anyone can copy a logo in ten seconds.

Newer tricks to watch for

Attackers adapt quickly. Watch for QR codes in emails that lead to fake login pages on your phone, where it is harder to inspect the address. Be wary of “shared document” notifications from real services like OneDrive or DocuSign that link to malicious files, and of messages that arrive from a real but compromised account belonging to someone you know. AI tools also make it easy to produce flawless, personalized text, so good grammar is no longer a sign of legitimacy.

When in doubt, verify out-of-band

The single most reliable defense is to confirm the request through a different channel. Call the person using a number you already have, not one in the email. Open the company’s website or app yourself instead of clicking a link. A real request will still be there; a fake one falls apart.

Pro tip: Most email platforms, including Outlook and Gmail, have a built-in “Report phishing” button. Using it trains the filters and helps protect everyone else in your organization.

Make it a habit

You will not spot every fake every time, and that is why multifactor authentication, updated software and good backups matter too. But a quick pause and a 30-second check stops the vast majority of phishing attempts before they start.