How to Spot a Phishing Email: 7 Warning Signs
Phishing is the most common way accounts get stolen, and it does not need a software flaw — it targets you. A convincing message asks you to log in, confirm a payment, or open an attachment, and the attack works only if you believe it. The good news: most campaigns leak clues long before you click. These seven warning signs catch the vast majority of fakes.
The seven warning signs
- The sender's address does not match the name. Display names are free text — anyone can appear as "PayPal Support". Expand the sender details or hover the name to see the real address. If the domain after the @ has nothing to do with the brand (paypal-secure-login.xyz), stop reading. If it is close but wrong (paypa1.com, extra hyphens, a swapped letter), the message is fake.
- Urgency and threats. "Your account will be suspended within 24 hours." "Unusual sign-in — confirm now." The pressure exists to keep you from checking independently. Real companies do send real deadlines, but they rarely pair panic with a link to fix it. Treat any message demanding immediate action as hostile until proven otherwise.
- Generic greetings. "Dear Customer" instead of your name is not conclusive on its own — plenty of legitimate senders use templates — but a service you have used for years knows your name and usually uses it. A vague greeting stacked on other oddities is a strong hint.
- Links whose real destination does not match the brand. The blue text saying paypal.com proves nothing. Hover on desktop or long-press on mobile to preview the real URL, then read it from the right: the domain just before the first single slash is where you actually land. Watch for extra subdomains (paypal.com.security-check.co), shortened links, and lookalike characters.
- Unexpected attachments. An invoice you never ordered, a "scanned document" you were not expecting, a shipping label for a parcel that does not exist. Be extra wary of .zip, .html, and .exe files, and of documents that ask you to enable macros. If it is unexpected, verify through the official website instead of opening it.
- Requests for passwords, codes, or payments. No legitimate service asks for your password by email, ever. One-time codes are even more sensitive — they are the key that unlocks your account. Treat any email asking you to type a code, "confirm" card numbers, or make an urgent payment (especially in gift cards or crypto) as a scam.
- Odd tone or vague details. Phishing often reads slightly wrong — awkward phrasing, a logo that is close but not right, a footer from a different brand, an order number that matches nothing. If something feels just a little off, trust that feeling and verify independently before doing anything.
What to do when you spot one
- Do not click anything, do not reply, and do not open attachments. Replying only confirms your address is live.
- Verify through the official channel. Type the company's domain yourself or open its app and sign in directly. If there is a real alert, it will be waiting inside your account.
- Report it. Most mail clients have a "Report phishing" or "Mark as spam" button. National cyber agencies such as CISA publish guidance and accept reports, and the brand being impersonated usually runs an abuse address as well.
- If you already clicked: change that account's password immediately (and anywhere you reused it), turn on two-factor authentication, and review sessions and devices you do not recognize. If you entered payment details, call your bank.
- Do not forward it as a warning. The links stay live, and a forwarded scam often finds new victims.
Why a disposable address is a defensive layer
Phishing gets much less dangerous when there is nothing of value behind the address it was sent to. If a one-time service was registered with a temporary address from Salmamail, and that service is later breached or sells its lists, the leaked address leads nowhere: no real identity, no history, no accounts you care about.
- A fake bank alert in a temp inbox proves itself fake instantly — your real bank never had that address to begin with.
- Every address you keep out of circulation is one less place your inbox can leak from — and less exposure means less phishing aimed at you in the first place.
Salmamail gives you a free, disposable inbox that works right in your browser with no sign-up. It updates live, detects verification codes automatically, and cleans up forgotten mailboxes. It is receive-only, so keep one-time sign-ups here and anything important in your real inbox.
One last thing: the seven signs above apply to every inbox. A disposable address limits what phishing can steal; it does not stop anyone from trying. Slowing down is still the best defense.
The bottom line
Phishing works by selling panic and looking official. Slow down, check the real domain instead of the display name, and pause before clicking anything urgent. Keep your real address for the accounts you plan to keep and use disposable addresses for everything else — the less your real address appears online, the less phishing there is to spot.