Every day, scammers send out millions of fake emails and texts, hoping just one person will click the wrong link. These tricks are called phishing (say it like “fishing”) because scammers “cast a line” and wait to see who bites.
If you’ve ever wondered how to tell if an email is fake or how to check if a link is safe, you’re in the right place. This guide breaks down exactly what to look for — no tech background needed.
By the end of this article, you’ll know how to:
- Spot a fake website address (URL)
- Identify a spoofed or fake email address
- Safely test a suspicious link before clicking
Why Phishing Emails Work So Well
Scammers don’t need to trick everyone — they only need a few people to fall for it. That’s why phishing emails and texts often use pressure tactics designed to make you act before you think, such as:
- “Your account will be closed in 24 hours!”
- “You’ve won a prize — claim it now!”
- “Suspicious login detected — verify your identity immediately.”
When a message makes you feel rushed, scared, or overly excited, that reaction is often the scam working exactly as designed. The single best defense against any scam is the same: slow down before you click anything.
Signs of a Phishing Email: How to Spot a Fake URL
A URL is the web address you see at the top of your browser, like www.amazon.com. Scammers build fake websites that look almost identical to real ones — but the address itself is the giveaway.
1. Read the URL slowly, left to right
The most important part of any web address is the domain name — the part directly before “.com,” “.org,” or “.net.” Scammers often bury the real company name somewhere else in the address to confuse you.
Example of a fake URL:
https://www.amazon-security-check.verify-account.com
This looks like Amazon, but the real domain is verify-account.com, not amazon.com. Everything before it is just filler designed to fool your eyes.
2. Watch for misspellings and swapped letters
This trick is known as typosquatting, and it’s one of the most common signs of a phishing website:
- paypa1.com (a “1” instead of the letter “l”)
- netfilx.com (letters swapped)
- faceb00k.com (zeros instead of “o”)
3. Be cautious of extra words or dashes
Real companies rarely use long addresses full of dashes and extra words:
www.bank-of-america-login-secure.com
A legitimate bank website is usually short and simple, like www.bankofamerica.com.
4. Don’t fully trust the padlock icon
Many people believe the padlock icon or “https” automatically means a website is safe. That’s outdated advice — scammers can get padlocks and “https” too. It only means the connection is encrypted, not that the site is trustworthy. Treat it as one small clue, not proof.
5. Hover before you click
On a computer, hover your mouse over a link without clicking. The real destination usually appears at the bottom of the screen. On a phone, press and hold a link to preview the address before opening it. If the visible text says “Click here to verify your account” but the real link goes somewhere unrelated, that’s a red flag.
How to Identify a Spoofed or Fake Email Address
“Spoofing” means faking something to look real. Scammers spoof email addresses so their messages appear to come from a company or person you already trust.
1. Check the full email address, not just the display name
Email apps often show a friendly name, like “Amazon Support,” instead of the real address behind it. Always tap or click the sender’s name to reveal the actual email address.
Example of a spoofed email:
Display name: "Amazon Support"
Real address: amazon.support@security-alert24.netA genuine Amazon email will always come from an address ending in @amazon.com — never an unrelated domain.
2. Compare the domain to the official one
Just like with URLs, look closely at what comes right before “.com” in the email address. Watch for:
- Extra words: support@amazon-help.com
- Wrong endings: @amazon.co or @amazon.info instead of @amazon.com
- Letter swaps: @arnazon.com (using “rn” to mimic “m”)
3. Be suspicious of generic greetings
Companies you have an account with usually know your name. A message starting with “Dear Customer” or “Dear User” is more likely to be a mass-sent scam than a personal message.
4. Watch for poor grammar and awkward wording
Many phishing emails are written quickly or translated poorly, leading to strange phrasing or spelling mistakes. That said, some scams today are well-written, so don’t rely on this sign alone.
5. Be wary of urgent requests for personal information
Legitimate companies almost never ask you to confirm your password, Social Security number, or credit card number by email. Treat any such request as a scam until proven otherwise.
6. Check for mismatched “reply-to” addresses
Sometimes a phishing email looks fine at first glance, but the “reply-to” address (visible in your email’s full header or message details) leads to a completely different, unrelated domain. This is a strong sign of spoofing.
How to Check If a Link Is Safe Before Clicking
Sometimes you’re not sure if a link is safe but still want to investigate. Here’s how to check it without putting yourself at risk.
1. Never click directly — copy the link instead
On most devices, press and hold a link to bring up a menu with an option like “Copy Link.” This lets you inspect it or run it through a checking tool without ever opening it.
2. Use a free link-checking tool
Several free tools exist specifically for this purpose. Paste the suspicious link in and they’ll flag known dangerous sites:
- Google Safe Browsing site status checker
- VirusTotal (scans a link against dozens of security services at once)
- URLVoid
3. Go directly to the source instead
If a message claims to be from your bank, PayPal, or any other service, skip the link entirely. Open a new tab, type the company’s website address yourself, or use their official app. Then log in normally and check for the alleged issue.
4. Verify the sender through a separate channel
If a message claims to be from a coworker, friend, or family member asking you to click a link or send money, contact them another way — call, text, or message them on a platform you know is really them — before taking any action.
5. Search the exact message online
Copy a piece of the email’s text and search for it, along with the word “scam.” Many phishing campaigns are sent to thousands of people, so others may have already reported it publicly.
6. Inspect the link’s code (advanced, optional)
On a computer, right-click a link and choose “Inspect” to view the raw HTML behind it. This sometimes reveals a different destination than what’s visibly shown. Not necessary for most people, but useful for extra certainty.
Quick Checklist Before You Click Anything
☐ Am I feeling rushed, scared, or overly excited? (Pause if yes.)
☐ Does the sender’s real email address match the company’s official domain?
☐ Is the greeting generic instead of using my name?
☐ Does the URL have extra words, dashes, or misspellings?
☐ Is it asking me for a password, card number, or personal details?
☐ Have I hovered over or copied the link to check it first?
☐ Could I just visit the official website or app myself instead of clicking?
If you answered “yes” to any warning sign above, don’t click. Delete the message or report it to the company being impersonated.
Frequently Asked Questions
How can I tell if an email is a phishing scam?
Check the sender’s full email address (not just the display name), look for generic greetings like “Dear Customer,” watch for urgent or scary language, and never trust a message that asks for passwords or personal information directly.
What does a fake URL usually look like?
Fake URLs often contain the real brand name plus extra words and dashes, such as amazon-security-check.verify-account.com. The true domain is the part directly before “.com,” which in this case is verify-account.com, not Amazon.
Is it safe to hover over a link to check it?
Yes. Hovering over a link (or pressing and holding on mobile) previews the real destination without opening it, making it one of the safest ways to check a link before clicking.
Can a phishing email really look 100% legitimate?
Yes. Some phishing emails copy real logos, formatting, and language almost perfectly. That’s why checking the actual sender address and the real link destination matters more than how “official” a message looks.
What should I do if I already clicked a phishing link?
Disconnect from the internet if possible, change your passwords immediately (especially if you entered any), enable two-factor authentication, and run a security scan on your device.
Final Thoughts
Scammers rely on speed and fear to catch people off guard. The best defense isn’t special software — it’s slowing down for just ten seconds to check the sender, the address, and the link before you act. Once that habit is built, most phishing attempts become obvious at a glance.
