Why the inbox is such a common target
Email is the one address almost everyone has, and it is the key to many other accounts. Password resets, bank notices and shopping receipts all land there. That makes it attractive to people who send fraudulent messages, and it makes ordinary mistakes costly. The good news is that a handful of habits handle most of the risk, and none of them require technical skill.
The central idea is simple: a message can look official without being official. Logos, names and formatting are easy to copy. What you can control is how quickly you react to what a message asks of you.
Slow down when a message creates pressure
Most fraudulent messages share one trait: they try to hurry you. They claim an account will be closed, a payment failed, a package is stuck, or a boss needs something done right now. Urgency is not proof of fraud, since real companies do send time-sensitive notices. But pressure combined with a request to click, pay or sign in is a reason to pause.
A useful rule of thumb is to treat the feeling of being rushed as information. When you notice it, step away from the message and check the claim a different way, such as by opening the company’s app or typing its address yourself.
Look at the sender, but do not rely on it
The display name is the easiest part of an email to fake. The underlying address matters more, so it is worth checking it, especially on a phone where only the name may show by default. Things to look for include:
- An address that does not match the organization it claims to be from.
- Small spelling changes, extra words or unusual endings in the domain.
- A reply-to address that differs from the sender.
- A message that addresses you generically when the sender should know your name.
None of these alone is conclusive. A genuine company can send from an odd-looking address, and a careful sender can use a convincing one. Treat the sender check as one clue among several, not a verdict.
Treat links with care
A link’s visible text and its real destination can differ. On a computer you can usually hover over a link to preview where it goes; on a phone, a long press often shows the address. Reading the destination carefully helps, and the skills involved are the same as those in spotting lookalike web addresses, where one swapped letter or an extra word is the giveaway.
The safest habit is to avoid using links in unexpected messages for anything sensitive. If an email says your bank needs attention, open your bank’s app or type its address yourself. That one step defeats a large share of phishing messages, because the fake page never gets a chance to appear.
Be cautious with attachments
Files are another way harmful software can arrive. Unexpected invoices, shipping documents, voicemail files and “scanned” pages are common disguises. The specific cues are covered under risky email attachments, but the general habit is this: if you did not expect the file, confirm with the sender through another channel before opening it. Keeping your device updated and your files backed up limits the damage if something slips through, which is part of why data backup basics matter even for people who rarely worry about email.
Never share codes or passwords by reply
Legitimate services do not ask you to email your password. They also should not ask you to read back a one-time code. Such codes exist to prove that you are the person signing in, and anyone asking for one is usually trying to sign in as you. If a message asks for either, treat it as a warning sign, whoever it appears to come from.
Use the tools your email provider offers
Spam filtering catches a great deal before it reaches you, and it improves when you report junk rather than just deleting it. Marking a message as spam or phishing, where the option exists, helps the filter learn. Turning on two-step sign-in adds protection even if your password leaks, and a password manager makes it easier to use a different password everywhere. These habits do not depend on you spotting every trick.
Keep your address from spreading everywhere
Every site that holds your address is a possible source of unwanted mail, and of exposure if that site is breached. Using different addresses for different purposes reduces both problems, and it makes unexpected messages easier to judge. If an email claiming to be from a store arrives at an address you only gave a newsletter, that mismatch is a clue.
If you clicked something you should not have
Mistakes happen to careful people, and a calm response matters more than embarrassment. A reasonable sequence is:
- Disconnect from the page without entering anything further.
- If you typed a password, change it right away on the real site, and on any other site where you used the same one.
- If you opened an unexpected file, run a security scan with your device’s built-in or trusted tools and keep your system updated.
- Watch your accounts and statements for activity you do not recognize.
- If money or financial details are involved, contact your bank or card provider promptly using the number on your card or official website.
Our guidance on what to do when an account is hacked goes further, but the first minutes are usually the ones that matter. Telling your bank or provider early generally gives you more options, though outcomes vary and cannot be promised.
Helping others
Older relatives, teenagers and busy coworkers are all common recipients of risky messages. A short, judgment-free conversation works better than a warning list. Encourage the habit of asking before acting: “Does this look right to you?” is a healthy question to normalize in a household or workplace. If a message threatens someone or involves a child, contact your local police or your national child-protection hotline, and call local emergency services if anyone is in immediate danger.
A short checklist
- Pause when a message pushes you to act quickly.
- Check the sender’s real address, but treat it as one clue.
- Go to websites yourself instead of using links in unexpected messages.
- Confirm unexpected attachments through another channel.
- Never send passwords or one-time codes by reply.
- Report junk and phishing to your provider.
- If you slip up, act quickly and calmly.
Email safety is mostly a matter of routine. Small, repeated habits do more than any single clever trick, and they keep working as the messages themselves change.