Phishing Email and Text Anatomy: Sender, Link, Attachment and Urgency Checks

How to Tell If a Message Is Phishing

A phishing email or text is a fake message built to look like it came from a company or person you trust. It wants you to click a link, open an attachment, or type in personal information. You can catch most of them by checking four things every time: who sent it, where the link actually goes, whether it has an attachment you did not expect, and whether it is pushing you to act right now.

This guide walks through that four-point check, gives you a fast decision path, and tells you exactly what to do if you already clicked or replied.

If You Already Clicked a Link or Gave Out Information, Do This First

Handle this before anything else on this page. Speed matters more than perfection.

• If you typed in a password: Change that password right away, and change it anywhere else you reused it.
• If you gave a Social Security, bank, or credit card number: Go to IdentityTheft.gov for the exact next steps based on what was exposed.
• If you opened an attachment or think software installed itself: Update your device’s security software, then run a full scan and remove anything it flags.
• If money already moved: Contact your bank or card issuer immediately and ask about reversing the transaction or freezing the account.
• Either way: Report the message. Instructions are in the reporting section below.

The Four-Point Message Check

Scammers rewrite their scripts constantly, but the four weak points in a phishing message rarely change. Work through all four before you act on any unexpected email or text.

1. Check the Sender

Look past the display name. Tap or hover on it to see the actual email address or phone number. A message that claims to be from your bank but comes from a string of random letters and numbers, or from a personal-looking Gmail address, is a red flag. Real companies also do not usually change the sender address between messages, so compare it to a past legitimate email if you have one.

2. Check the Link

Do not tap it yet. On a computer, hover your mouse over the link to see the real web address in the corner of the screen. On a phone, press and hold the link to preview it. Look for small misspellings of a real company name, extra words added to the domain, or a domain that does not match the company at all. According to the Federal Trade Commission, even a link that looks legitimate can carry malware, so never copy and paste a suspicious link into your browser either.

3. Check the Attachment

Be suspicious of any attachment you were not expecting, especially invoices, shipping labels, voicemail files, or documents that ask you to “enable content” or “enable macros” to view them. That request is a common way to get harmful software running on your device. If you were not expecting a file from that sender, do not open it. Contact the sender through a separate, known channel to confirm they actually sent it.

4. Check the Urgency

Phishing messages almost always try to rush you. Watch for language claiming your account will be closed today, that you will be charged unless you act now, or that legal trouble is coming if you do not respond. The Cybersecurity and Infrastructure Security Agency (CISA) notes that urgent or emotionally charged language claiming dire consequences for not responding immediately is one of the clearest signs of a phishing attempt. A real company will not threaten to cancel your account inside a text message.

Quick Checklist Before You Click Anything

• Does the sender address match a company address you have seen before?
• Does the link’s real destination match the company’s actual website?
• Is there an attachment you were not expecting?
• Does the message use pressure, threats, or a countdown to force quick action?
• Does it ask you to confirm a password, account number, or Social Security number?
• Is the greeting generic (“Dear Customer”) instead of using your name?

If you answered yes to any of these, treat the message as phishing until you can verify it through a separate, trusted channel.

Verification Decision Path

Use this path any time a message asks you to click, log in, or provide information.

1. Ask: Do I actually have an account with this company, or do I know this person?
2. If no: This is almost certainly phishing. Do not click, reply, or open attachments. Report and delete it.
3. If yes: Do not use any phone number, link, or “contact us” button inside the message.
4. Find the company’s real number or website from a bill, the back of your card, or a search you type in yourself.
5. Contact them directly and ask if the message is real before you act on it.
6. Only proceed once a real representative confirms the request, using their official system, not a link from the message.

How to Report a Phishing Email or Text

Reporting helps get scam messages and the sites behind them shut down. The FTC recommends these steps:

• Phishing email: Forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.
• Phishing text message: Forward it to SPAM (7726).
• Either type: File a report at ReportFraud.ftc.gov.
• On social media or messaging apps: Most platforms have a built-in “report” option near the sender’s name or in the app’s settings menu, as CISA notes in its phishing guidance.

After you report a message, delete it. Do not reply, and do not click “unsubscribe” links inside a suspicious message, since that link can also be fake.

Who Should Use Extra Caution

Everyone is a target, but a few situations raise the stakes:

• Anyone who manages banking, bills, or benefits for an aging parent or family member, since scammers often target caregivers with urgent “account problem” messages.
• Small business owners and employees who handle payments, payroll, or wire transfers, since a single convincing invoice email can cost real money fast.
• Anyone contacted about an unexpected government refund, benefit increase, or unclaimed money, which the FTC lists as a common phishing lure.
• Anyone using a personal device for both work and banking apps, since one compromised login can expose more than one account.

What This Guide Does Not Cover

This article explains how to inspect a message and respond safely. It does not replace your bank’s or employer’s specific security procedures, and it is not a substitute for professional IT or legal help if you believe a scammer accessed business systems or sensitive company data. Scam tactics also change constantly, so treat this as a starting checklist, not a complete list of every warning sign you will ever see.

Frequently Asked Questions

How can I tell a phishing text from a real one?

Check where it actually asks you to go. A real company rarely asks you to confirm account details or click a link to “fix” a payment problem by text. If a text pressures you to act immediately or asks for personal information, verify it by contacting the company directly using a number from your bill or their official app.

Is it safe to open an email if I do not click any links?

Simply opening a plain text or HTML email is generally low risk. The danger comes from clicking links, opening attachments, or replying with personal information. If an email or text arrived with a file attached that you were not expecting, avoid opening the attachment itself.

What if the phishing message uses my real name and recent purchase details?

Scammers sometimes use information from earlier data breaches to make messages look personal and convincing. Having your name or a real order number does not confirm the message is legitimate. Still verify through a separate, known contact method before clicking anything.

I already clicked a link but did not enter any information. What should I do?

Update your device’s security software and run a scan, since some links try to install harmful software just from being opened. Watch your accounts for unusual activity over the following weeks, and report the message using the steps above.

Related Reading

• Package Delivery Text Scams: Links, Tracking Numbers and Reporting
• AI Voice Clone Scams: A Family Verification Plan
• Online Marketplace Seller Verification: Identity, Reviews, Returns and Counterfeits
• How to Spot Fake Countdown Timers and Scarcity Claims

Educational Disclaimer

This article is for general education only. It is not legal, financial, or cybersecurity advice for your specific situation. If you believe you are a victim of fraud or identity theft, contact your bank, IdentityTheft.gov, or a qualified professional for guidance based on your circumstances.