What is the fastest way to check if an email is phishing?

Compare the real sender address with the display name, then hover the primary link and read its actual destination. Those two checks catch the large majority of phishing attempts in under ten seconds.

Is it safe to open a phishing email?

Opening the message is generally safe in a modern mail client with remote images blocked. The risk comes from clicking links, opening attachments, or enabling macros. Do not do those things while investigating.

What should I do if I already clicked the link?

If you entered credentials, change that password immediately and revoke active sessions, then enable multi-factor authentication. Report it to your security team and monitor the account for unusual sign-ins or forwarding rules.

Can email headers prove an email is fake?

Often, yes. SPF, DKIM and DMARC results in the headers show whether the sending server was authorized for that domain, and the Received chain shows the true path the message travelled.

How to spot a phishing email: 10 red flags

Phishing works because it looks routine. The signals below are what an analyst checks first — in roughly the order that gets to an answer fastest. Work down the list, and when a message still looks plausible, settle it with the headers.

The red flags

1. The sender address doesn't match the display name

Display names are free text — anyone can write "Microsoft Support". Expand the header and read the actual address. A message from "PayPal" sent from billing@paypal-secure-alerts.co is a forgery. Also compare From, Reply-To and Return-Path: when replies would go somewhere else entirely, treat the message as hostile.

2. It manufactures urgency or fear

"Your account will be closed in 24 hours." "Unauthorized login detected — confirm now." Urgency exists to stop you from checking. Legitimate companies rarely give you a same-day deadline to keep your own account, and never require a link to do it.

3. The link text and the real destination differ

Hover over any link (or long-press on mobile) and read the status bar. Anchor text saying https://login.microsoft.com pointing at http://ms-verify.ru/login is the single most reliable phishing signal there is.

4. The domain is a lookalike

Watch for extra words (apple-support.com), swapped characters (rnicrosoft.com, paypa1.com), unusual TLDs (.zip, .top, .xyz) and subdomain tricks where the brand appears left of the real domain: paypal.com.secure-login.io is owned by secure-login.io.

5. Authentication failed

Full headers include SPF, DKIM and DMARC results. A bank whose mail shows dmarc=fail or spf=softfail did not send that message from an authorized server. This is the forensic answer when everything else looks convincing.

6. It asks for credentials, MFA codes or payment details

No legitimate provider asks you to enter a password or one-time code via an emailed link. Requests to "re-verify" banking details, or to update payroll or supplier bank accounts, are the highest-loss phishing category.

7. A generic or wrong greeting

"Dear Customer" or "Dear user@example.com" from a service that knows your name is a bulk-send tell. Conversely, targeted spear phishing may use your correct name and job title — accuracy alone is not proof of legitimacy.

8. Unexpected attachments

Be sceptical of .html, .htm, .iso, .img, .zip, .7z and macro-enabled Office files (.docm, .xlsm). HTML attachments are increasingly used to render a fake login page locally, which hides the phishing URL from mail filters.

9. Language and formatting anomalies

Odd spacing, inconsistent fonts, low-resolution logos, mixed locales in dates and currency, or phrasing that is slightly off. AI-written phishing has reduced obvious typos, so weigh this alongside the technical signals rather than on its own.

10. It breaks an existing process

An invoice from a known supplier with new bank details. A CEO asking for gift cards. An IT request outside the ticketing system. Any message that asks you to bypass a normal procedure deserves out-of-band confirmation on a number you already have.

Verify it forensically

Manual checks tell you when something feels wrong. Header forensics tell you whether it is wrong. PhishingSonar parses the full source, checks SPF, DKIM and DMARC, compares display links against their real destinations, flags lookalike domains and social-engineering tactics, and extracts IOCs you can hand to your SOC. Email content is never stored, and the built-in redaction tool scrubs PII in your browser before anything is sent.

Analyze a suspicious email Try the quick demo

Frequently asked questions

What is the fastest way to check if an email is phishing?: Compare the real sender address with the display name, then hover the primary link and read its actual destination. Those two checks catch the large majority of phishing attempts in under ten seconds.
Is it safe to open a phishing email?: Opening the message is generally safe in a modern mail client with remote images blocked. The risk comes from clicking links, opening attachments, or enabling macros. Do not do those things while investigating.
What should I do if I already clicked the link?: If you entered credentials, change that password immediately and revoke active sessions, then enable multi-factor authentication. Report it to your security team and monitor the account for unusual sign-ins or forwarding rules.
Can email headers prove an email is fake?: Often, yes. SPF, DKIM and DMARC results in the headers show whether the sending server was authorized for that domain, and the Received chain shows the true path the message travelled.