An email can look familiar and still ask you to do something unsafe. Rather than trying to memorize every possible scam, build a repeatable way to examine unexpected requests. This guide focuses on the decision you control: whether to trust the message enough to take its requested action. It does not ask you to investigate suspicious infrastructure, open attachments to test them, or become an email-forensics expert.
Our suggested review begins with three questions. Were you expecting this request? Can you verify the sender or event independently? What would happen if you followed the instructions and the message were false? A request to read a public announcement and a request to disclose a password deserve different levels of scrutiny. The aim is to slow down consequential decisions, especially when a message pressures you to move quickly or keep the request secret.
Look at the request before judging the design
A polished layout, recognizable logo, or friendly greeting does not explain why a sender needs your credentials or an unusual payment. Start by identifying the actual instruction. Is the email asking you to sign in, send information, install something, move money, scan a code, or change a security setting? Restating the request in plain language can make an otherwise persuasive message easier to assess.
Google's official guidance on avoiding and reporting phishing describes deceptive requests, impersonation, warnings, and independent verification. Those are the factual foundations for this guide. The scenarios and review routine here are illustrative suggestions. No visual checklist can certify that a message is safe, and an absence of obvious mistakes does not settle the question. When a message asks for something consequential, seek confirmation outside the message rather than trying to resolve every uncertainty inside it.
Separate a display name from a verified relationship
Your email app may prominently show a display name while making the full address less visible. Expand the sender details when necessary, but do not treat a plausible address as the end of your review. Ask whether the communication fits the relationship and the conversation. An unusual instruction from a familiar contact still deserves verification. Your objective is to confirm the request, not merely recognize the name above it.
For a fictional example, imagine a message apparently from a colleague requesting a new destination for a supplier payment. Compare the request with your normal process. If that kind of change requires a separate approval, follow the process even if the message appears inside a familiar conversation. Use a previously known contact method to confirm it. Do not use a phone number supplied only by the questionable message as your independent channel; that would leave the same unverified source controlling both sides of the check.
Treat urgency as a reason to pause
Urgency can be legitimate, so the word “urgent” is not a reliable verdict. The more useful question is whether the requested shortcut makes sense. A message might insist that you bypass an approval, disable a protection, or keep a transaction confidential. Instead of arguing with the message, step outside its proposed sequence. Open the service through your normal app or a known bookmark and check whether the relevant event exists there.
Consider an example claiming that your account will close unless you sign in immediately. You do not need to decide whether the email's design is authentic before checking your account independently. Go through the route you normally use. If the issue is real, address it there. If the message concerns work, use the reporting and verification channels your organization has established. A deliberate pause can be a sensible response to uncertainty, not a failure to respond promptly.
Inspect destinations without following the invitation
On devices that reveal a link destination without opening it, that information may help you spot a mismatch. But do not turn link inspection into a requirement to interact with a suspicious message. Long URLs, redirects, and mobile interfaces can make the exercise difficult. If you cannot confidently assess the destination, use the independent-navigation approach instead. You are not obligated to inspect every embedded link before deciding not to use it.
Apply the same reasoning to QR codes, shortened links, and attached documents that invite you to sign in elsewhere. The format does not change your goal: establish whether the requested action is legitimate through a trustworthy route. Avoid pasting private email links or attachments into public analysis services without permission. Such material can contain personal information or access tokens. When you need technical help, follow your provider's or employer's approved reporting process rather than improvising a public investigation.
Do not make spelling your main defense
Obvious errors can attract your attention, but good spelling is not a certificate of legitimacy. A message can be well written and still contain an inappropriate request. Likewise, a genuine sender can make mistakes. Judge the request, context, and verification route together. This avoids a simplistic rule in which a professional-looking message gets an automatic pass and an imperfect message gets automatically dismissed.
Try a short rehearsal using a fictional example: “Your document is ready. Sign in to view it.” Ask who was supposed to send the document, what project it belongs to, and whether you can access it through your existing workspace. If none of that context exists, do not let curiosity supply the missing trust. If the context does exist, open the known workspace directly. This approach is more useful than relying on a single stylistic clue.
Choose the right response to uncertainty
When you suspect phishing, use your email provider's reporting function or your workplace's prescribed channel. Avoid replying to argue with the sender or asking them to prove their identity through the same thread. Where an administrator handles suspicious messages, describe the concern briefly and follow instructions about preserving evidence. You do not need to forward the content to unrelated people or reproduce dangerous links in a group chat.
If a message seems merely unwanted rather than deceptive, the appropriate action may instead be spam reporting or a legitimate subscription preference change. Our spam filtering overview explains that distinction. These categories can overlap, so prioritize the risky request when one is present. The main objective is not to achieve perfect classification vocabulary; it is to avoid taking an unverified action and to route the concern to someone who can assess it appropriately.
Respond proportionately after an accidental interaction
An accidental click and disclosure of a password are different situations. Think about what actually happened: did you only open a page, enter credentials, approve a sign-in, download a file, or run software? Stop interacting with the message. Use the service's legitimate security or recovery route, and contact your organization's support team promptly for a work account. Describe the actions you took accurately so the response can match the exposure.
Do not assume deleting the email reverses a completed action. Equally, avoid deciding that every accidental click means your device is certainly compromised. Keep the response grounded in what you know and let the relevant support process guide further steps. Our email account security checklist helps you review normal protections, but it is not an incident-response service. For an ongoing workplace incident, your organization's security procedures take precedence over a general educational article.
Make verification the habit
The most reusable takeaway is a decision rule: verify consequential, unexpected requests through a route that does not depend on the message itself. Keep that rule available even when you are rushed, curious, or impressed by a familiar logo. You do not need to win a guessing game about every email. You need a trustworthy path for the actions that matter. Visit Email Security for the surrounding concepts and a starting point for a calmer review routine.
