Short answer: Treat urgency + unexpected links + look-alike senders as guilt until proven otherwise. Check the real domain (not the display name), hover every link, and never “verify” through the message itself. When you’re still unsure, paste the text into a second-opinion tool like PhishCheck AI for a No obvious red flags found / Suspicious / Likely scam read — then contact the company only through its official site.
AI-written phishing often has no typos. Fake bank alerts, password resets, and “your package is on hold” notes look polished. Inbox filters catch a lot; they still miss enough that people need a quick personal check.
Why “does it look professional?” is a bad test
Older advice said: bad grammar = scam. That still helps sometimes, but modern phishing is drafted by models that write clean English. Trust patterns, not polish:
- Pressure to act in hours
- A link that is the only way to “fix” or “verify”
- A sender that looks like a brand but isn’t the brand domain
- A request for passwords, one-time codes, gift cards, or crypto
Your mail app’s spam folder is a first filter. PhishCheck (and similar second opinions) exist for the message that still feels off after it landed in the inbox.
The 7 red flags (checklist)
1. Urgency that skips thinking
“Account locked in 24 hours.” “Unauthorized charge — confirm now.” Scammers sell panic. Real banks rarely force you through a single emailed link with a countdown.
2. Display name ≠ real address
The From line may show PayPal Security while the actual address is [email protected] or a random Gmail. On desktop, expand the full sender. On mobile, tap the name to reveal the address.
3. Look-alike and one-letter-off domains
micros0ft.com, apple-id-support.net, fedex-track.top. One swapped character or an extra word after the brand is a classic tell. Type the official site yourself instead of clicking.
4. Short links and odd TLDs
bit.ly/... or unfamiliar endings (.xyz, .top, .click) hiding the real destination. Hover (desktop) or long-press (mobile) before you open anything.
5. Asks for secrets the company already has
Passwords, full card numbers, SMS codes, seed phrases. Support will not email you asking for these. If they need you signed in, they send you to their known domain — which you should still open by typing, not clicking.
6. Unexpected attachments or “enable macros”
Invoices you didn’t expect, .html attachments, or Word docs that demand macros. Prefer viewing statements inside the official app.
7. You weren’t expecting the topic
Tax refunds you didn’t file for, packages you didn’t order, tolls in cities you never drove through. Unexpected + pay-via-link is almost always smishing or phishing.
A 2-minute personal workflow
- Don’t click yet. Screenshot or copy the text.
- Read the full sender address and any Reply-To.
- Hover / long-press links — does the URL match the brand’s real domain?
- Open a fresh tab, type the company site or open the official app, and check there (balance, tracking, recent logins).
- If still unsure, paste the message (you can redact names and account numbers) into PhishCheck AI for a second opinion with listed red flags.
- Report obvious phishing to your provider (Gmail “Report phishing”) and, in the US, reportfraud.ftc.gov. Forward samples to
[email protected].
What PhishCheck is (and isn’t)
PhishCheck AI is a paste → review warning signs → act helper: email, SMS, or link in; verdict and plain-English reasons out. Free browser rule-based demo (not live AI), no card required. Pasted text is not uploaded or saved by this app and is not used for training. Hosting request metadata is separate.
It can be wrong. It is a second opinion, not a guarantee — same honesty we put on the landing FAQ. When in doubt, use official channels only.
Demo note: the public checker runs locally in your browser with simple rules — live AI is not available. Pasted text is not uploaded or saved by this app; hosting request metadata is separate — see the privacy notice. Not a safety guarantee.
Still not sure? Paste it.
Check a message free on PhishCheck AI →
FAQ
Is this email a scam if it has no spelling errors?
Not necessarily either way. Modern phishing is often well written. Judge urgency, sender domain, links, and unexpected payment asks — not grammar alone.
Can Gmail or Outlook already catch everything?
No. Filters are strong but incomplete. A second opinion helps on messages that still feel wrong in the inbox.
Do I need to paste my full email including passwords?
No. Redact personal details. Never paste passwords, one-time codes, or full card numbers into any checker.
Does PhishCheck store my messages?
No. The browser demo does not upload or save pasted text in app storage. Hosting providers may log request metadata (IP, URL, browser). Optional email feedback is separate. See the privacy notice.
What should I do if I already clicked?
Close the tab, change passwords from the official site, enable 2FA, call your bank if you entered card details, and scan your device. See our guide: I clicked a phishing link — what now? (publish alongside this pack).