Most malware and account breaches don't start with a sophisticated hack — they start with someone clicking a link in a convincing email. Here's what to check before you do.

Red Flags to Check

1. The sender address, not just the display name. "Microsoft Support" can be typed by anyone — hover over or tap the sender's name to see the actual email address. Look for misspelled domains like micros0ft-support.com or extra subdomains tacked onto a real-looking name.
2. Urgency and threats. "Your account will be suspended in 24 hours" or "Immediate action required" is a pressure tactic designed to stop you from thinking it through.
3. Generic greetings. "Dear Customer" or "Dear User" instead of your name is common in mass phishing campaigns, though targeted attacks (spear phishing) may use your real name.
4. Links that don't match their text. Hover over any link (without clicking) to see the actual destination URL in the status bar or a tooltip. If the link text says "Office 365" but the URL is some unrelated domain, don't click it.
5. Unexpected attachments. Especially .zip, .exe, or "enable macros to view" Word/Excel files you weren't expecting, even from someone you know — their account may be compromised.
6. Requests for credentials or payment. Legitimate companies do not ask you to email your password. Be equally suspicious of unexpected invoice or wire transfer requests, even from what looks like your CEO or a vendor.

What to Do If You're Not Sure

• Don't click any links or open attachments.
• Contact the supposed sender through a separate, known channel (call them, or start a new email using an address you already have) rather than replying to the email itself.
• Report it to your IT team or use your email client's built-in "Report Phishing" option.

Common Questions

Can a phishing email infect me just by opening it?

Simply opening a plain-text or HTML email is very unlikely to infect your device on its own in modern email clients. The risk comes from clicking links, opening attachments, or enabling macros/content the email prompts you to enable.

What if I already clicked a link but didn't enter any information?

If you didn't type in a password or download anything, the risk is much lower, but it's still worth changing the password for the account the email impersonated and keeping an eye on that account for unusual activity.