This page contains affiliate links. If you make a purchase through one, we may earn a commission at no extra cost to you.
Phishing emails used to be easy to spot — bad grammar, obviously fake logos, an implausible story. AI-written phishing has closed most of that gap, so the reliable signals now live somewhere else: the sender address, the actual link destination, and the pressure to act immediately.
The Sender Address, Not the Display Name
Email clients show a display name by default, and that name is trivial to fake — an email can say “Amazon Security” while actually coming from a completely unrelated address. Check the full sender address, not just the name, and look specifically for domains that resemble a real one without being it: a zero substituted for a letter, an extra word inserted, a different top-level domain than the real company uses. This single check catches a large share of phishing attempts on its own.
Hover Before You Click, Every Time
The visible link text in an email can say anything regardless of where the link actually goes. On a desktop, hovering over a link (without clicking) shows the real destination URL, usually in a small preview at the bottom of your email client or browser. On mobile, a long-press does the same thing. A mismatch between what the link says and where it actually points is one of the most reliable phishing signals there is, and it’s not something AI-generated writing can fake the way it can fake polished prose.
Urgency Is a Manufactured Pressure Tactic
“Your account will be suspended in 24 hours,” “Immediate action required,” a message that appears to come from an executive demanding something be handled right now — legitimate organizations very rarely create this kind of time pressure over email. The urgency itself is the tell: it’s designed to get you to act before you’d normally stop and check the sender address or hover over a link, which is exactly the deliberation a real phishing email is trying to short-circuit.
Unexpected Attachments and QR Codes
An attachment you didn’t request — an invoice, a shipping label, an HR document — is worth treating with real suspicion regardless of how legitimate the email looks otherwise. QR codes embedded in emails are a newer and fast-growing version of the same trick, specifically because image-based content slips past a lot of text-based spam filtering. If an email asks you to scan a QR code to “verify” an account or “confirm” a delivery, that’s the same red flag as a suspicious link, just in a format that’s harder for automated filters to catch.
No Legitimate Organization Asks for a Password by Email
This one is close to an absolute rule: a real bank, employer, or service provider will never ask you to reply with or enter your password, PIN, or full account number directly through an email link. If you’re ever unsure whether a request is legitimate, navigate to the site directly by typing the address yourself rather than clicking through the email, and check your account from there instead.
A Password Manager Is a Real, Practical Defense Here
This is a genuinely useful side benefit of using a password manager rather than typing credentials manually: RoboForm and similar tools match saved logins to the exact domain they were created for, so they simply won’t offer to autofill your credentials on a convincing lookalike site with a slightly different URL — a real, practical check that doesn’t rely on you personally catching a subtle domain mismatch under time pressure. See our password manager guide if you don’t already use one.
Are phishing emails still easy to spot by bad grammar and spelling?
Not reliably anymore — AI-written phishing emails are often polished and professional, closing the gap that grammar mistakes used to reveal. The sender address, real link destination, and urgency tactics are more reliable signals now.
How do I check where a link in an email actually goes without clicking it?
On desktop, hover your cursor over the link without clicking to reveal the real destination URL, usually shown in a small preview. On mobile, a long-press does the same thing.
Can a password manager actually help me avoid phishing?
Yes, in a practical way — password managers match saved logins to the exact domain they were created for, so they won’t autofill your credentials on a convincing lookalike phishing site with a slightly different URL.