Phishing and scam emails try to trick you into giving up information, money, or access. While they're increasingly sophisticated, most contain recognizable warning signs.
Key warning signs of a scam or phishing email:
1. Urgency and threats: Scammers create panic — 'Your account will be closed in 24 hours,' 'Suspicious activity detected, act now,' 'You owe money.' Legitimate companies rarely demand immediate action under threat.
2. Requests for sensitive information: Real banks, government agencies, and reputable companies will NEVER ask for your password, full Social Security number, or full card details via email.
3. Suspicious sender address: Check the actual email address, not just the display name. Scammers use addresses like 'service@paypa1-secure.com' (note the misspelling or odd domain) instead of the real company domain. The display name can say anything.
4. Generic greetings: 'Dear Customer' or 'Dear User' instead of your name can indicate a mass phishing attempt (though some scams do use your name from data breaches).
5. Spelling and grammar errors: Many scam emails contain awkward phrasing, typos, or grammatical mistakes (though AI is making some scams more polished).
6. Suspicious links: Hover over links (on desktop) without clicking to see the real destination URL. If it doesn't match the supposed company's website, it's likely a scam. On mobile, press and hold to preview.
7. Unexpected attachments: Especially .zip, .exe, or document files you weren't expecting — these can contain malware.
8. Too good to be true: 'You've won a prize,' 'Claim your refund,' 'You've inherited money.' If you didn't enter, you didn't win.
9. Mismatched or odd URLs and branding: Logos that look slightly off, or links that go to unrelated domains.
10. Requests for payment in unusual ways: Gift cards, wire transfers, or cryptocurrency are favored by scammers because they're hard to reverse. No legitimate organization demands payment in gift cards.
How to protect yourself:
1. Don't click links or open attachments in suspicious emails. Instead, go directly to the company's official website by typing the address yourself, or call them using a number from their official site (not from the email).
2. Verify independently: If 'your bank' emails about a problem, log in through the official app or website directly, not through the email link.
3. Never give sensitive info via email.
4. Enable two-factor authentication so a stolen password alone isn't enough.
5. When in doubt, don't act — contact the company through official channels.
The takeaway: Phishing emails rely on urgency, fear, and deception. Be suspicious of unexpected emails demanding action, requesting sensitive information, or containing odd links and sender addresses. When in doubt, never click — verify directly through the company's official website or phone number instead.