Learning how to spot a phishing email in seconds is one of the most useful skills you can build before the holidays, because phishing attacks surge every November and December. Scammers know you are expecting delivery updates and sale alerts, so they send convincing fakes — and one careless click can hand over your password or card details. Most phishing emails give themselves away quickly if you know what to look for.

Key Facts

• Phishing emails pretend to be from a trusted company, bank, delivery service, or government agency to trick you into sharing personal information.
• Phishing attacks increase sharply during the holiday shopping season, when people expect more emails about orders and deliveries.
• A genuine company will never ask you to send a password, card number, or verification code by email.
• Hovering over a link (without clicking) shows the real web address it leads to.
• If you clicked a suspicious link, changing your password and enabling two-factor authentication are the first steps.
• You can report phishing emails to the company being impersonated and to the authorities.

What a Phishing Email Actually Is

A phishing email is a fake message designed to look real. The sender wants you to click a link, open an attachment, or reply with information. The link usually leads to a fake login page copying a real website — your bank, email provider, delivery company, or a shop — and anything you type there goes straight to the scammer.

The classic holiday examples are easy to picture: a delivery notice saying your parcel could not be delivered, a message about a failed payment for an order you never placed, or a warning that your account will be closed. For a wider look at seasonal fraud, see our guide on how to spot holiday shopping scams online.

Check the Sender First

The sender’s address is the fastest check you can do. A real email comes from that company’s own domain, while a phishing email often comes from a lookalike domain: a misspelled company name, extra words, or a free email service pretending to be a business.

Look closely at the full address, not just the display name. Email apps show a friendly name, but tapping or hovering over it reveals the real address underneath. If the address does not match the company at all, treat the email as suspicious.

Read the Message Like a Detective

Phishing emails rely on urgency. They want you to act before you think, using phrases like “act now” or “your account will be closed today”. A genuine company rarely threatens you with instant consequences by email — if a message makes your heart race, slow down, because that urgency is the trick. Look for sloppy details: spelling mistakes, awkward grammar, and strange formatting are common in phishing emails, though well-made fakes can be clean too, so a tidy email is not proof it is safe.

Check whether the message greets you by name or with a generic “Dear customer” — real companies that know you usually use your name — and be suspicious of unexpected attachments, especially files claiming to be invoices.

Another warning sign is a request for information the company should already have. No bank, shop, or delivery company needs your full card number, password, or verification code by email — if a message asks for these, it is almost certainly a scam.

Inspect Links Before You Click

Never click a link in a suspicious email. Instead, hover over it, or press and hold it on a phone, to see the real address it leads to. A link that claims to go to a well-known website but points to a strange domain or a shortened link is a clear red flag.

The safest habit is to ignore links in emails altogether and go to the website yourself. If an email says there is a problem with your order, type the shop’s address yourself and check your account there; if it claims to be from your bank, open your banking app directly. This one habit defeats most phishing attempts.

Be careful with shortened links and QR codes too, since both hide the real destination, and remember a padlock icon does not mean a site is genuine — it only means the connection is encrypted.

The Holiday Parcel Trap

Delivery phishing is the biggest holiday variant, and it works because parcels are genuinely arriving. A fake message says your parcel is delayed, held at customs, or needs a small fee to release it, and includes a link to “track” or “pay” that steals your card details or installs malware.

Real delivery companies do not ask you to pay unexpected fees by email link, and they do not ask for passwords. If you are expecting a parcel, track it through the courier’s official app or website, using the tracking number from your original order confirmation. Our guide on how to protect packages from porch pirates covers keeping real deliveries safe.

The same caution applies to shopping emails: a huge discount from a shop you have never used is often a fake shop designed to take your payment and disappear. Before buying from an unfamiliar store, check our Black Friday shopping tips for 2026 to shop safely.

What to Do If You Clicked a Bad Link

If you clicked a suspicious link, do not panic — act quickly and calmly. Do not enter any information on the page that opened; close it. If you did enter a password, change it immediately, starting with the account the phishing page was copying, and change the same password anywhere else you used it.

If you entered card details, contact your bank or card provider straight away. They can block the card, watch for suspicious transactions, and reverse charges if needed. Check your accounts for unusual activity over the next few days.

Then report the phishing attempt: most email services let you report a message as phishing with one click, which helps protect other people, and you can forward it to the company being impersonated. The US Federal Trade Commission provides clear, practical advice in the FTC’s guide to recognizing phishing scams, including how to report phishing and what to do if you shared personal information.

Build Habits That Keep You Safe

Spotting phishing gets easier with a few steady habits. Use a password manager so each account has a unique password, turn on two-factor authentication on your email, bank, and shopping accounts, and keep your devices updated.

Be careful about what you share publicly too. Scammers use details from social media to make phishing emails more convincing — a message that mentions your recent order or your town feels personal, but the information may have come from a public post. Talk about phishing with your family, especially older relatives who may be targeted more often: show them how to check a sender address and hover over a link — a two-minute conversation can prevent a costly mistake.

Phishing emails will keep coming, especially at this time of year, but they only work when they catch you off guard.

Check the sender, slow down when a message feels urgent, inspect links before clicking, and go to the real website yourself. Those four habits will keep you safe through the holidays and all year round.

Frequently Asked Questions

How can I tell if an email is phishing?
Check the sender’s full address, look for urgency, inspect links before clicking, and watch for requests for passwords or card details. If anything feels off, go to the company’s real website yourself.

What should I do if I clicked a phishing link?
Close the page without entering information. If you entered a password, change it immediately and enable two-factor authentication. If you entered card details, contact your bank straight away.

Do real companies ever ask for my password by email?
No. A genuine company will never ask you to send a password, full card number, or verification code by email. Any message that asks for these is almost certainly a scam.

Can a phishing email infect my computer without me clicking anything?
Simply opening an email is very unlikely to infect a modern, updated device — the risk comes from clicking links or opening attachments.

What is the difference between phishing and spam?
Spam is unwanted bulk email, usually advertising. Phishing is a targeted scam that pretends to be from a trusted source to steal your information or money. All phishing is spam, but most spam is not phishing.

How do I report a phishing email?
Use the “report phishing” option in your email service, forward the message to the company being impersonated, and report it to the FTC.