Phishing emails remain one of the most effective tools in a cyber criminal's arsenal. A single convincing email can compromise your accounts without any malware at all. Attackers simply need you to believe you are logging into a legitimate website while typing your credentials into their clone.
The threat is widespread. More than 50% of internet users receive at least one phishing email every day. Most get filtered, but it takes only one successful attempt to create a security nightmare. Here is how to spot the fakes before you hand over anything valuable.
Check the actual web address
The most reliable way to identify a phishing attempt is to examine the URL before you click anything.
When you receive an email claiming to be from a service you use, hover over any link without clicking. The actual destination appears somewhere on your screen—usually at the bottom of your browser or in a popup near the cursor. That destination must start with http:// or https://. Anything else is a red flag.
Now look at what comes before the first forward slash. That is the true domain name. For Facebook, the legitimate address ends with facebook.com. Scammers register similar-looking domains like faacebook.com, faceb00k.com, or facebook-login.com. Any variation in spelling or the addition of extra words means you are looking at an impostor.
The subdomain trick
Even careful users sometimes miss a more sophisticated manipulation: the subdomain. Legitimate services use subdomains all the time. Mail.yahoo.com is a subdomain of yahoo.com. En-gb.facebook.com is a subdomain of facebook.com. These are fine.
Phishers exploit this structure by reversing it. An address like facebook.com.phishingsite.com places you inside phishingsite.com, not Facebook at all. The real domain—the part you actually care about—is always the segment immediately before the final dot and the two letters after it.
Our analysis
Phishing persists because it exploits human psychology rather than software vulnerabilities. Attackers craft emails with convincing logos, plausible subject lines, and urgency ("your account will be suspended"). By the time you notice something off, you may have already typed your password into their form.
Major email providers have strengthened their spam filters, catching the bulk of mass campaigns. But targeted attacks—those personalized to specific individuals—often slip through because they are low-volume and carefully crafted. No filter is foolproof.
The trade-off is real: security measures that catch more phishing create friction for legitimate email. Services walk a fine line between blocking valid messages and letting threats through. Your vigilance remains the final layer of defense.
A worked example
Say you receive an urgent email from "support@apple-verify.com" claiming your Apple ID has been locked. It asks you to click a link and confirm your password.
Before clicking anything, you hover over the button. The destination reads apple-verify.com.thatfreesite.biz. You now know two things: the sender address is not apple.com, and the actual link leads to a site called thatfreesite.biz, not Apple's infrastructure. This is a phishing attempt. Delete the email. If you are genuinely concerned about your Apple ID, visit apple.com directly by typing it into your browser.
Who should care
| User type | Risk level | Priority action |
|---|---|---|
| Online banking users | High | Verify all financial emails by calling your bank directly |
| Social media users | Medium-High | Enable two-factor authentication on all accounts |
| Remote workers | High | Confirm unexpected requests through separate communication channels |
| General users | Medium | Default to typing URLs directly rather than clicking email links |
Bottom line
Phishing relies on your trust and your haste. Slow down. Check URLs before clicking. When in doubt, navigate directly to the service by typing its address into your browser. No legitimate company will ever ask you to confirm sensitive information via an email link. That single habit—never entering credentials from an email link—blocks most attacks.
Key takeaways
- Always hover over links to verify the actual destination URL before clicking
- Check the domain immediately before the final dot—it should match the service you expect
- Be suspicious of any email creating urgency around account issues
- Type service URLs directly into your browser rather than following email links
- More than 50% of internet users receive at least one phishing email daily
Frequently asked questions
How can I tell if an email link is actually safe to click?
Hover over the link without clicking and check that the URL starts with https:// and ends with the correct domain name before any forward slash, with no unexpected characters or subdomains.
What should I do if I accidentally clicked a phishing link?
Immediately change the password for the affected account, enable two-factor authentication if available, and contact the actual service provider to report the attempt.
Are phishing attacks only trying to steal passwords?
No, attackers also target bank details, credit card numbers, social security information, and any personal data that can be exploited for financial gain or identity theft.
Can spam filters completely protect me from phishing emails?
No, while spam filters catch most mass phishing campaigns, targeted spear phishing attempts often bypass filters due to their personalized nature and low volume.
Why do phishing emails sometimes look exactly like real messages from legitimate companies?
Attackers copy legitimate email templates, logos, and formatting, then combine this with convincing text and urgency to make their messages appear authentic.