ICE How to Spot a Phishing Email (Without Becoming Paranoid)
You don't need to distrust every email you get. You need five specific things to glance at before you click.
Most phishing emails aren't sophisticated. They rely on you being busy, moving fast, and not looking closely. That's actually good news — it means there's a short, concrete checklist that catches the overwhelming majority of them. No need to treat every email like a threat.
1. Check who it's actually from, not just the display name
"Microsoft Support" can display as the name while the actual address is something like security-alert@mlcrosoft-billing.net. Tap or hover on the sender name to see the real address. A mismatched or slightly-off domain is the single most reliable tell.
2. Notice if it's creating urgency
"Your account will be suspended in 24 hours." "Immediate action required." "Unusual sign-in detected." Real companies send notifications too — but scammers lean on urgency specifically because it short-circuits careful reading. If an email is pushing you to act fast, that's exactly when to slow down.
3. Look at the greeting
"Dear Customer" or "Dear User" instead of your actual name is common in phishing, since the sender is blasting the same email to thousands of addresses. Not every legitimate email uses your name either, but a generic greeting paired with urgency is a strong combination to be suspicious of.
4. Hover before you click — don't tap on instinct
On a computer, hover over any link without clicking — the real destination usually shows in the bottom corner of your browser. On a phone, press and hold a link to preview it. If the link text says "yourbank.com" but the actual destination is something else entirely, that's the email answering its own question.
5. Be extra careful with anything about money or credentials
Requests to change a payment account, "verify" your password by logging in through a link, or update billing information are the highest-value phishing targets because they pay off directly. For anything involving money or login credentials, go around the email entirely — open the actual website yourself by typing the address, or call the company using a number you already know is real.
The single best habit: if an email is asking you to act urgently on money, passwords, or account access, verify it through a channel you already trust — not by replying or clicking anything in the email itself.
What if you already clicked something?
Don't panic, and don't hide it. Change the password for that account right away (from a different, untouched device if possible), turn on multi-factor authentication if it isn't already on, and let your IT support know so they can check for anything else that might need attention. Catching it fast matters more than catching it perfectly.
Want a real look at where you stand?
The Cybersecurity & Device Health Check covers exactly this — MFA, password hygiene, and a plain-English report.