How to Spot a Phishing Email
One of the most common ways scammers steal passwords, bank details and personal information is through phishing emails.
A phishing email is simply a message that pretends to be from a trusted company, government department or someone you know, hoping you'll click a link or provide information.
The good news is that most phishing emails leave clues once you know what to look for.
Why Are They So Convincing?
Years ago, businesses were much smaller.
You often knew your local bank manager, the post office staff, or the person who ran your local shop.
The same was true for many services. For example, many people remember having a family doctor or someone who knew you and your medical history, and who you would see almost every time you visited your GP surgery.
Today, healthcare is often much busier. While many practices may try to provide continuity of care where possible, it's now too common to be offered the first available doctor (if you can get an appointment) rather than always seeing the same person.
The same change has happened across all large organisations.
Banks, delivery companies, utility providers and online retailers now communicate with millions of customers every day. Most emails are generated automatically by computer systems rather than written by a person, let alone one who knows you.
Scammers take advantage of this.
Because people already expect automated emails, fake messages can sometimes appear surprisingly believable.
Remember: An Email Can Pretend to Be Anyone
Receiving an email that appears to come from a bank, delivery company or government department does not automatically mean it really came from them.
Modern scammers are very good at copying:
Company logos.
Colours and branding.
Email layouts.
Signatures.
Legal notices.
Sometimes the fake email looks almost identical to the real thing.
That's why you should always verify the message before acting on it.
Check the Sender's Address
The name shown in your inbox isn't always the real sender.
For example, your inbox might simply say:
Royal Mail
But when you click or tap the sender's details, the actual email address could be something completely different.
A genuine company email usually comes from that company's own domain.
For example, ours is:
A fake email might come from something like:
or a misspelling, for example:
If the address looks unusual, be cautious.
Don't Trust the Link
One of the oldest phishing tricks is to make a button say one thing while sending you somewhere completely different.
Before clicking:
Move your mouse over the link (without clicking) to see where it actually goes.
On a phone or tablet, press and hold the link to preview the address.
If the website address doesn't match the company you're expecting, don't click it.
When in Doubt, Visit the Website Yourself
This is one of the safest habits you can develop.
Instead of clicking the link in the email:
Open your web browser.
Type the company's website address yourself.
Or use a search engine to find the company's official website.
If there's really a problem with your account, you'll usually find the same information after signing in normally.
Use Website Checkers
If you're unsure about a website, free online tools can help you investigate it.
These services can often tell you:
Whether a website has been reported as malicious.
How old the website is.
Whether it has been associated with scams.
If other users have reported suspicious activity.
They shouldn't be your only line of defence, but they can provide another useful clue.
Watch Out for Pressure
Scammers want you to panic.
Common phrases include:
"Your account will be closed today."
"Immediate action required."
"Your parcel will be returned."
"Your bank account has been suspended."
"Click here immediately."
Legitimate companies sometimes send urgent emails, but they generally won't pressure you into making instant decisions without giving you another way to verify the information.
Never Be Embarrassed to Double-Check
Scammers are professionals.
Their emails are designed to fool ordinary people, and they become more convincing every year.
If something doesn't feel quite right:
Ask a friend or family member.
Contact the company using a phone number from its official website.
Visit the company's website directly instead of using the email link.
Taking five minutes to check could save you hundreds or even thousands of pounds.
The Bottom Line
The world has changed.
Computers automatically generate almost all genuine emails today, and scammers know this. They take advantage of the fact that people are used to receiving messages from organisations they never speak to directly.
That's why it's no longer enough to trust an email simply because it looks professional.
Instead, get into the habit of checking who sent it, where the links go, and whether you can verify the information independently.
A genuine company will never mind if you take a few extra minutes to make sure you're really talking to them. A scammer, on the other hand, is hoping you won't.
If you need more advice or want to talk to someone who can explain this in more detail at your own pace, send us a message.