The Most Common Indicators of a Phishing Attempt (With Screenshots)

When it comes to online fraud, scammers view your personal information as currency, and they’ll stop at nothing to get it.

One of the most common tactics fraudsters use to collect your data is phishing. This technique involves impersonating a real company or person you know and asking you for your information.

This is often done through an email campaign that gets spammed out to as many people as possible, knowing that most people won’t bite, but some of them will.

Luckily for you, it’s easy to spot a common indicator of a phishing attempt as long as you know what you’re looking for.

Here are seven easy ways for you to avoid a phishing attempt:

1. Check the Subject Line

Before you even open an email, you’ll have a pretty good idea if you’re dealing with a phishing attempt by what’s in the subject line.

The first thing to look out for is an urgent tone. The scammer wants to strike fear into your heart and then compel you to make a decision as quickly as possible. This is done by using urgent words and phrases like:

• “Warning”
• “Protect your funds”
• “Delivery Failed”
• “Urgent Request”
• “Expired”
• “Account Compromised”
• “Immediate Action Required”

You should also worry about promotional-based words and phrases like “Free While Supplies Last” and “Limited Time Offer.” The fear of missing out on a good deal is just as powerful as the fear of something going wrong.

If you receive an email that starts with an urgent subject line, it may be best to not open it at all, especially if it’s from a company you’ve never interacted with before.

2. Check The Greeting

The very first thing you’ll see in almost any email is a greeting. It’s also the first red flag to indicate that it’s a phishing attempt.

Do any of these greetings feel generic to you?

• “Dear Sir”
• “Dear Madam”
• “Dear account holder”
• “Dear user”
• “Dear member”
• “Valued customer”
• “Hi” or “Hello”

How about this one:

Generic greetings also include phrases like this:

If the email is from a company that you’ve never dealt with before, these greetings make sense.

If the email is from your bank or another important service in your life, getting a generic greeting like this instead of one that uses your full name is a major red flag. ** If the email is from a “friend” or “family” member, there’s a high chance you’re dealing with a phishing attempt.

Also, just because a message greets you with your first name doesn’t mean it's safe. Scammers can get your name in many ways, so it may be best not to trust any greeting.

3. Check For Spelling and Grammar Issues

Professional emails are written by professional writers and looked over by professional editors. Finding one typo in an email sent by a reputable company is a red flag.

Ok, fine, maybe you can let one typo go before hitting the delete button, but if you’re constantly tripping over spelling and grammar errors as you skim down the text, you’re most likely dealing with a phishing attempt.

This includes not just misspelled words but also improper word placement, bad punctuation, repeated words, and clunky capitalization.

Here’s a quick list of common errors you might find in a fraudulent email:

• “Definitely” spelled as “definitely”

• “Separate” spelled as “seperate”

• “Receive” spelled as “recieve”

• “Believe” spelled as “beleive”

• “Accommodation” spelled as “accomodation”

• “Occasionally” spelled as “ocassion”

  
  

When it comes to emails from regular people and not companies, it’s always possible that the person who wrote the email was not fluent in English. But it’s more likely that you’re dealing with a phishing attempt.

4. Check the Sender and the Request

Most fraudsters understand the power of authority and credibility when it comes to creating phishing emails. The most common way to gain these attributes is to pretend to be someone in power or someone known for being knowledgeable about a specific subject.

Once they establish themselves as an authority, they will then make a request designed to steal your information. The trick about this request is that it’s reasonable. If the request was something like, “I need you to transfer $5,000 to my account today,” no one would click on it, so the request is usually information that’s easy for the recipient to give up.

This one-two punch of an “authority” making a “reasonable request” can come in many different forms:

• A “manager at a bank” asking you to look over an invoice
• “Amazon” asking you to verify your address for your upcoming package delivery
• Your “internet provider” telling you to install a program to retain access
• A “reputable company” offering you a digital receipt
• A “government employee” requesting your tax information

These requests are unsolicited, and they’re worded as if you’ve already had a conversation with them when you haven’t.

5. Avoid Attachments and Links

Just as a general rule, if you get an email with an attachment in it, unless you know the person, don’t open that attachment.

According to one malware-detecting service, over 45% of the attachments they scanned in 2023 were malicious. Sure, that’s about a 50/50 chance, but it’s better to be safe than sorry and avoid any of these types of attachments:

• .exe

• .zip

• .scr

• .jar

  
  

As for links, the same general rule applies: if you don’t know the person, don’t click on the link.

If you’re curious about the link, you can always hover your mouse over it to see a preview of its destination. Chances are, you’ll find that the link doesn’t take you where the email tells you it takes you. It’s likely that the link takes you to a fake site designed to steal your information.

It’s best not to click on the link at all.

6. Check the Domain

Here’s where fraudsters get really creative.

Crafty scammers will try to impersonate real companies by using domain names similar to trusted entities.

There are a few different ways this could look:

Misspelled Domain

Obviously, there’s no way for a scammer to send a legitimate email from [email protected], but it’s not hard for someone to send you a message from [email protected].

A misspelled domain can be tough to catch if you don’t look for it. Instead of quickly scanning the sender’s domain, take a nice long look at it and make sure there’s not a typo in there somewhere.

Also, look out for domains that contain special characters, for example, support@Amazon!.com, or support@~Amazon.com.

Domains With Extra Words

Here’s another one that’s tough to catch. Instead of adding a typo to the name of a business, the scammer adds an extra word next to the real name:

• [email protected]

• [email protected]

• [email protected]

  
  

If you receive an email from a business with an extra word in the domain, it doesn’t mean it’s a scam automatically, but it is a red flag.

**

Public Domains

An email from a big-name company will always end with the company's name in question, for instance, @Amazon.com.

If you get an email from [email protected] or [email protected], it’s a scam.

This is even more true if the domain is just a person’s name with a public domain.

7. Avoid Too Good to be True Offers

This might be the easiest way to spot a phishing scam as long as you know what to look for.

A too-good-to-be-true offer could come in the form of a free item that’s normally very expensive or a way to make a lot of money with any details on how it works. Here are some quick examples:

• “Here’s your free iPhone!”

• “Open now to win a luxury vacation to the Maldives.”

• “90% off designer handbags. Limited time offer, just for you!”

• “Foolproof investment plan. Guaranteed overnight success!”

• “Here’s how to get a free PS5 by tomorrow night.”

  
  

People fall for these types of schemes every day, and it’s easy to do if you let yourself believe that you caught a lucky break.

Unfortunately, there are no lucky breaks in your inbox, just scams.

Final Thoughts

As long as the internet exists, scammers will exist. Thankfully, if you keep an eye out for the most common indicators of a phishing attempt, you’ll be just fine.

As a general rule, it may be best to treat every email in your inbox as potentially malicious unless you know the sender personally.

For more information about cybercrime, check out these recent articles:

Payment Fraud Stats From the World's Most Popular Apps: Zelle, Venmo, Cash App, Paypal,

and More

How to Protect Your Facebook Account From Being Hacked

What is a Cybercrime Investigator? (and How to Become One)