Phishing Emails: How to Spot, Report and Stop Them (2026)

Short answer: A phishing email pretends to come from someone you trust, like your bank, a delivery company or your boss, to get you to click a link, open an attachment or hand over a password or payment details. Warning signs are pressure to act fast, a request for personal or financial information, and a sender address or link that's slightly off. Don't click; contact the company through its real website or phone number instead, then report the message (Report phishing in Gmail, Report > Report phishing in Outlook) and delete it. Spam is unwanted bulk mail; phishing is spam built to steal from you.

This guide covers the three email threats people run into most: phishing, ordinary spam, and email bombing, where your inbox is flooded on purpose to hide something worse. The advice comes from the US Federal Trade Commission (FTC), the US Cybersecurity and Infrastructure Security Agency (CISA), the UK's National Cyber Security Centre (NCSC) and the email providers themselves.

What are phishing emails?

Phishing is an attempt to steal personal information or break into accounts using messages and sites that imitate ones you already use. The FTC says scammers are after your passwords, account numbers and Social Security number, which can get them into your email, bank or other accounts, or which they sell on to other criminals. The email is just the delivery method: the damage happens on the fake login page it links to, in the attachment that installs malware, or in the reply you send.

Who sends them? Mostly criminals working at scale, sending the same message to huge lists and waiting for a small share of people to bite. A smaller group researches specific targets first, which makes their emails much harder to spot.

How to recognise a phishing email

The FTC notes that phishing emails usually tell a story to get you to click. Typical ones:

• There's been suspicious activity or a login attempt on your account.
• There's a problem with your account or payment details, so it's on hold.
• You need to confirm personal or financial information.
• An invoice you don't recognise, or a link to make a payment.
• You're eligible for a refund, a prize or free stuff.

The NCSC groups the pressure tactics behind these stories. Look for any of these:

Then check the details:

• The sender's actual address. The display name can say anything. Look at the address after it for misspellings and lookalike domains (CISA's example is amazan.com).
• Where links really go. On a computer, hover over a link without clicking to see the real destination. On a phone, press and hold. Shortened links you can't read are a warning sign in themselves.
• Generic greetings. "Dear customer" instead of your name, from a company that knows your name.
• Requests no real company makes by email. The FTC says legitimate companies won't email you a link to update your payment information.
• QR codes in emails. The NCSC warns that criminals increasingly put QR codes in phishing emails to get you onto a scam site from your phone, where the address is harder to check.

One old rule no longer works: bad spelling. Both CISA and the NCSC point out that AI tools now let scammers write clean, convincing text, so a well-written email proves nothing. If you want to dig further, the message's email headers show which servers it really came through.

Common types of phishing attack

• Mass phishing: the same fake bank, delivery or account notice sent to millions of addresses.
• Spear phishing: aimed at one person or organisation, using details gathered about them so it feels genuine.
• Whaling: spear phishing aimed at executives and others who can approve payments or release data.
• Impersonation of someone you know: a message that looks like it's from a colleague, friend or family member, often asking for money, gift cards or a quick favour.
• Smishing and vishing: the same tricks by text message and phone call, sometimes combined with email.

What to do if you get a phishing email

The FTC's test is one question: do I have an account with this company, or know this person?

1. If not, treat it as phishing. Report it (see below) and delete it.
2. If you do, don't use anything in the email. Go to the company's website yourself, or call a number from your card, a statement or the official site, and ask.
3. Don't reply, and don't click any link in it, including an unsubscribe link. CISA's advice is simply to delete it.

If you already clicked or replied

• If you entered a password, change it right away, and change it anywhere else you use the same one. Turn on multi-factor authentication if you haven't.
• If you opened an attachment or think you downloaded something, update your security software and run a full scan.
• If you gave out card, bank or Social Security details, the FTC points US readers to IdentityTheft.gov for a recovery plan. Call your bank too.

How to report phishing in Gmail, Outlook and Apple Mail

Reporting from inside your email app trains its filter and warns the provider. Steps from each provider:

You can also report to the authorities. In the US, the FTC asks you to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and report the attempt at ReportFraud.ftc.gov. In the UK, forward suspicious emails to the NCSC at report@phishing.gov.uk; you don't need to forward messages that are already in your junk folder.

Spam vs phishing: what's the difference?

Spam is any unsolicited bulk email: unwanted newsletters, ads, dubious offers. A lot of it is just annoying. Phishing is a kind of spam with a specific goal, getting something from you that a criminal can use. The FTC puts it this way: at best spam is annoying, at worst it's pushing scams or malware. Most spam is sent through botnets, networks of hacked computers, phones and smart devices, which is also why keeping your own devices updated matters.

How to stop spam emails

• Mark it as spam or junk instead of only deleting it. Each one you mark improves the filter.
• Block repeat senders or whole domains in your provider's settings.
• Unsubscribe from real mailing lists using your app's built-in unsubscribe banner, not a link in a suspicious email. Our guides cover unsubscribing in Gmail and unsubscribing in Mac Mail.
• Check your junk folder now and then for real mail the filter caught by mistake.
• Be careful who gets your address. The FTC notes that companies may share or sell it; a privacy policy tells you how it'll be used.

On a Mac, make sure Mail's filter is on under Mail > Settings > Junk Mail. Our guide to junk mail filtering in Mac Mail explains the options.

What is email bombing?

Email bombing (also called mail bombing, list bombing or subscription bombing) floods one address with hundreds or thousands of messages in a short time. MITRE ATT&CK, the industry's catalogue of attack techniques, describes the usual method: a bot signs your address up to many newsletters and mailing lists that don't confirm new sign-ups, and the confirmations and newsletters pour in. Because the mail comes from real newsletter sites, your provider can't simply block it.

Why attackers do it

The flood is usually cover. MITRE notes it buries legitimate messages, including security alerts. That's the point: a password reset notice, a new-login warning or a purchase confirmation from your bank gets lost among thousands of newsletters while someone uses your account. Dartmouth's IT team gives the same reason, and says people who handle financial data are targeted more often.

There's a second version aimed at workplaces. Microsoft Threat Intelligence reported in 2024 that a group it tracks as Storm-1811 bombed employees' inboxes and then phoned or messaged them posing as IT support, offering to fix the spam. The "fix" was remote access to the victim's computer, which led to ransomware.

What to do if you're being email bombed

1. Check your accounts first. Look at your bank, card, shopping and email accounts for purchases, password changes or new logins you didn't make. Search the flood for real alerts from those services.
2. Change your email password and turn on multi-factor authentication. At work, report it to your IT or security team, since it's a security incident, not just a nuisance.
3. Don't trust anyone who contacts you offering to fix it. In the attacks Microsoft describes, that call or chat was the attack. Hang up and call your help desk on the number you already know.
4. Don't click hundreds of unsubscribe links. Dartmouth advises against it: reputable lists usually stop on their own once you don't confirm, and shady ones may sell your address on.
5. Filter instead. Rules that send mail from known contacts to your inbox and everything else to a separate folder let you keep working while the wave passes.

Email phishing protection in Canary Mail

Disclosure: we make Canary Mail. Your provider's filter catches most phishing, but not all of it. Canary Mail's Pro+ plan ($100 a year) adds phishing and impersonation detection on top: it checks each email for spoofed senders and fake links and warns you before you click. Pro+ also includes PGP and SecureSend for encrypted email, and tracker blocking is on by default on every plan. Canary works with Gmail, Outlook, iCloud, Yahoo, Exchange and other IMAP accounts on Mac, iPhone, iPad, Windows and Android, with a 7-day trial. No filter is perfect, so the habits above still apply.

If you also want to encrypt what you send, see our guide to PGP encryption.

Frequently asked questions

Can I get phished just by opening an email?

Usually not. The harm comes from clicking a link, opening an attachment or replying with information. Opening a message can still tell the sender your address is active if it loads remote images, which is one reason to block trackers or turn off remote content.

How do I check if I was phished?

Think back to whether you entered a password, payment details or personal information after clicking a link, or opened an attachment. Then look for password reset emails, new-login alerts, changed recovery details or charges you don't recognise. If you find any, change your passwords and contact your bank.

What happens if my email gets phished?

If a scammer gets your email password, they can read your mail, reset passwords for other accounts that use that address, and send phishing from your account to your contacts. Change the password, turn on multi-factor authentication, sign out other sessions and check your forwarding rules.

Is spam the same as phishing?

No. Spam is any unwanted bulk email; phishing is a deceptive message designed to steal information or money. All phishing is spam, but most spam is just unwanted marketing.

How do I stop spam emails?

Mark spam as junk instead of only deleting it, block repeat senders, unsubscribe from legitimate lists with your app's unsubscribe button, and be careful where you give out your address. Your filter gets better with every message you mark.

How long does email bombing last?

There's no set length. The worst usually arrives as one wave of sign-up confirmations, but newsletters you were signed up to can keep coming afterwards. Filtering, rather than unsubscribing from each one, is the practical way through it.

Sources

• FTC: How to recognize and avoid phishing scams
• FTC: How to get less spam in your email
• CISA: Recognize and report phishing (archived)
• NCSC: How to spot a scam email, text message or call
• NCSC: Report a scam email
• Google: Avoid and report phishing emails
• Google: Report spam in Gmail
• Microsoft: Protect yourself from phishing
• Microsoft: Filter junk email and spam in Outlook
• Apple: Recognize and avoid phishing messages
• Apple Mail User Guide: Reduce junk mail
• MITRE ATT&CK: Email Bombing (T1667)
• Microsoft Threat Intelligence: Threat actors misusing Quick Assist (email bombing then fake IT calls)
• Dartmouth ITC: How to mitigate email bombing
• Canary Mail: Security features