How to tell if an email is a scam
Phishing emails try to rush you into clicking or sharing something. Once you know the pattern, they are easy to catch.
The red flags
- Urgency and threats. "Your account will be closed in 24 hours." Real companies rarely threaten like this.
- A sender address that is off. The display name may say a brand, but the actual email address is random or misspelled. Check the real address, not just the name.
- Links that do not match. Hover over a link (without clicking) to see where it really goes. If it is not the company's real website, do not click.
- Requests for codes, passwords or payment. No legitimate company emails you to ask for your password, a verification code, or a gift-card payment.
- Generic greetings and odd grammar. "Dear customer" plus clumsy wording is a common sign.
When in doubt, do not use the email's links. Go directly to the company's website by typing its address, and check your account there.
If you already clicked
Change the password for that account immediately (and anywhere you reused it), turn on two-step verification, and watch for unusual activity. If you entered card details, contact your bank.
Frequently asked questions
How can I check where an email link really goes?
Hover your mouse over the link (or press and hold on mobile) to preview the real web address before clicking. If it is not the official site, do not click.
A company emailed asking for a verification code. Is that normal?
No. Companies send codes for you to enter yourself; they never email or call to ask you to read a code back. That is a scam.