How to Spot a Phishing Email in 10 Seconds

The short version: Phishing is the most-reported internet crime in the United States. The FBI Internet Crime Complaint Center recorded 191,561 phishing and spoofing complaints in its 2025 Annual Report, the largest single category by complaint count, out of 1,008,597 complaints and $20.877 billion in reported losses. The advice most people carry, that phishing emails are full of spelling mistakes, is now close to useless. The signals that still work are structural: who actually sent the message, where a link actually goes, whether an attachment was expected, and whether the request manufactures urgency about money or credentials. And the single defence that beats all of the detection advice in this article is phishing-resistant authentication, which CISA, the NSA, the FBI and MS-ISAC recommended in joint guidance published in October 2023 precisely because it does not depend on anyone spotting anything.

What phishing is, and how big it actually is

Phishing is an attempt to get you to hand over something valuable, usually credentials, money, or access to a device, by impersonating someone you would reasonably trust. The channel varies. Email is the classic, but text messages, phone calls, messaging apps, social media and QR codes all carry it.

The numbers, and what they do and do not show

The FBI Internet Crime Complaint Center’s 2025 Annual Report puts phishing and spoofing at 191,561 complaints, ahead of every other crime type by volume. Business email compromise accounted for far fewer complaints, 24,768, but $3,046,598,558 in losses. Tech and customer support scams generated 47,794 complaints and $2,134,675,818. The average reported loss across all complaint types was $20,699.

The Anti-Phishing Working Group, in its Phishing Activity Trends Report for the fourth quarter of 2025 published on 18 February 2026, observed 853,244 unique phishing sites in that quarter alone and documented 3.8 million phishing attacks across 2025, a slight increase on 3.76 million in 2024. Social media and software-as-a-service or webmail providers were the joint most-targeted sectors, each at 20.3 percent of attacks.

Two honest caveats. These are reported figures, and most phishing is never reported, so treat them as a floor rather than a measurement. And complaint counts are not harm: the crime type with the most complaints is not the one that empties bank accounts.

The misconception: “I can spot them by the bad spelling”

This deserves direct correction, because it is the single most common piece of outdated advice and it actively creates risk.

Poor spelling was never a design feature of phishing. It was a side effect of non-native authors working at volume, and in some cases a deliberate filter to weed out people careful enough to be difficult later. Neither constraint applies now. Competent, fluent, correctly formatted messages are ordinary, and a well-made phishing page is visually identical to the real one, because it is frequently a copy of the real one.

The deeper problem with the spelling heuristic is not that it produces false negatives. It is that it produces false confidence. Someone who has learned to scan for typos will read a clean message and conclude it is genuine, which is exactly the wrong inference. Fluency is not evidence of anything.

The signals that still work

Display name versus the actual sending domain

The name shown in your inbox is a free-text field chosen by the sender. It is not verified and never has been. The part that matters is the domain after the at sign in the real address, and on mobile mail apps you often have to tap the sender to see it at all. A message from “Customer Security” at an address ending in a domain you do not recognise is the most reliable single tell that remains.

Where a link actually goes

Hover over a link on a computer, or press and hold on a phone, and read the hostname. Read it from the right. The meaningful part is the last two labels before the first slash. An address like secure-login.yourbank.example-verify.net is not your bank; it belongs to example-verify.net. Marketing and tracking redirectors make this harder than it should be, which is a genuine limitation of the advice and a reason not to rely on it alone.

Attachments, and which file types matter

The question that does most of the work is whether you were expecting a file from this person. Beyond that, treat executables and scripts as immediately hostile, be sceptical of office documents that ask you to enable content or macros, and be aware that archive files and disk images are commonly used to wrap something else past a scanner. A PDF is not automatically safe; many contain nothing but a link and a large button.

Urgency about money or credentials

Almost every successful phish compresses time. An account will be closed, a payment has failed, a package is held, a login must be confirmed within the hour. Urgency exists to stop you checking. Combined with a request that touches either money movement or credentials, it is the highest-value warning sign there is.

The channel switch

A request to move the conversation somewhere less accountable, from company email to a personal address, from email to a messaging app, from a written thread to a phone call, is a strong signal. It removes the logging, the colleagues and the delay.

How much each signal is still worth

Why a passing DMARC check does not mean safe

The three records in plain terms

SPF, defined in RFC 7208 published April 2014, lets a domain owner publish which servers are allowed to send mail for that domain. DKIM, defined in RFC 6376 published September 2011 and now an Internet Standard, attaches a cryptographic signature that proves a message was signed by the domain and not altered in transit. DMARC, most recently specified in RFC 9989 published May 2026 as a Proposed Standard that obsoletes the original RFC 7489 from March 2015, ties the two together: it tells receiving servers what to do when a message claiming to be from a domain fails both checks, and where to send reports.

The October 2023 joint guidance from CISA, the NSA, the FBI and MS-ISAC recommends enabling DMARC and configuring systems to “reject any incoming email that has a domain that is being spoofed when a DMARC policy of reject is enabled.”

What passing actually proves

Here is the part that is routinely misunderstood. These mechanisms authenticate the domain, not the intent. A message that passes SPF, DKIM and DMARC has proved only that it really was sent by whoever controls that domain.

An attacker who registers paypa1-secure.example.com this morning can publish perfect SPF and DKIM records for it by lunchtime and pass DMARC on every message. Worse, a genuinely compromised account at a real company sends mail that passes every check, because it is real mail from a real server. Authentication stops one attack, exact spoofing of a protected domain. It does not evaluate whether the sender is honest.

Look-alike and homograph domains

Once exact spoofing is blocked, attackers move to domains that merely look right. The substitutions are old and effective: the digit one for a lower-case L, the digit zero for O, the pair r and n rendered together to resemble an m, or an extra hyphen in a plausible place. Internationalised domain names extend this by allowing characters from other scripts that render nearly identically to Latin letters, which is why browsers display some domains in their raw encoded form rather than their pretty form.

The expensive variants, and what to do

Business email compromise

BEC is phishing without malware. The attacker impersonates an executive, a supplier or a conveyancer and asks for a payment to be redirected. The Anti-Phishing Working Group reported that the mean amount requested in wire transfer BEC attacks in the fourth quarter of 2025 was $50,297, up 4.5 percent on the previous quarter’s $48,115. At over $3 billion in reported losses across 24,768 complaints, it remains the costliest per-incident category the IC3 tracks.

Spear phishing, QR codes and text messages

Spear phishing targets one person using detail scraped from social media, company sites, data breaches and public records. The mention of your manager’s name, a genuine project, or a real invoice number is not evidence of authenticity; it is evidence of research.

QR codes hide the destination entirely, which is their entire appeal to attackers. The Federal Trade Commission issued a consumer alert in December 2023 warning that scammers hide harmful links in QR codes, including by pasting fake codes over legitimate ones in public places. Text-message phishing exploits the same gap, since almost no phone shows you a link’s full destination before you tap it.

If you clicked

Act in this order. If you entered a password, change it immediately on the real site, and change it anywhere else you reused it. If money moved, contact your bank at once. The IC3 2025 report is direct about this: “If you discover a fraudulent transfer, time is of the essence.” That urgency is justified by their own numbers. The IC3 Recovery Asset Team actioned 3,900 incidents in 2025 involving $1,163,919,846 in attempted theft and successfully froze $679,013,183, a 58 percent success rate, and freezes depend on speed. Then report it, run a malware scan if you downloaded anything, and tell your employer if it was a work account.

The decision rule: verify out of band before you act. Contact the organisation using a route you already had, the number printed on your card, the app already installed on your phone, a colleague’s known desk number, and never a number, link, address or QR code contained in the message itself. If you cannot verify it that way, do nothing. A genuine request survives a twenty-minute delay; a fraudulent one rarely does.

The structural defence

Everything above asks a human to notice something. Phishing-resistant authentication removes that requirement. The October 2023 joint guidance from CISA, the NSA, the FBI and MS-ISAC states that FIDO and PKI-based forms of multi-factor authentication “are phishing resistant and resilient against the threats listed,” and recommends prioritising them. The mechanism is simple: the credential is bound to the real site’s address, so it will not release anything to a look-alike, no matter how convincing the page is or how certain the user feels.

The corollary matters too. NIST Special Publication 800-63B Revision 4 states that “out-of-band authentication is not phishing-resistant” and classifies delivery over the public telephone network, meaning codes by SMS or voice call, as a restricted authenticator. A code you can read and type is a code you can be persuaded to read out. Passkeys and hardware security keys are not.

Where these figures come from

Complaint counts, loss totals and Recovery Asset Team figures are from the Federal Bureau of Investigation Internet Crime Complaint Center 2025 Annual Report. Phishing attack volumes, sector targeting and the mean BEC wire transfer request are from the Anti-Phishing Working Group Phishing Activity Trends Report for the fourth quarter of 2025, published 18 February 2026. Recommendations on phishing-resistant multi-factor authentication and DMARC are from Phishing Guidance: Stopping the Attack Cycle at Phase One, issued jointly by the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Federal Bureau of Investigation and the Multi-State Information Sharing and Analysis Center in October 2023. The statement that out-of-band authentication is not phishing-resistant is from NIST Special Publication 800-63B Revision 4. Email authentication specifications are RFC 7208 of April 2014 for SPF, RFC 6376 of September 2011 for DKIM, and RFC 9989 of May 2026 for DMARC. The QR code warning is from a Federal Trade Commission consumer alert of December 2023.

General information, current as of September 2026, and not personalised advice.