How to Spot a Phishing Email (A 5-Step Checklist)

Don’t be a victim. Scammers are getting smarter, but their tricks are easy to spot. The Secure Patrol gives you a simple 5-step checklist to identify and delete any phishing email in seconds.

It’s 9 AM on a Tuesday. An email lands in your inbox. Subject: Urgent: Your Amazon Account Has Been Locked.

Your heart jumps. You’re expecting a package. You click the link to “Verify Your Account,” and just like that, the trap snaps shut.

This is phishing—digital bait used by con artists to steal your passwords, credit card numbers, and personal identity. These scams are no longer sloppy, misspelled jokes. They are sophisticated, targeted, and dangerously effective.

As TheSecurePatrol.com, our job is to put you on watch. We see these threats every day. The good news? Once you know the warning signs, these fakes become glaringly obvious.

Here is your official 5-Step Patrol Checklist to spot a phishing email and protect your inbox.

---

Step 1: Interrogate the Sender (Don’t Trust the Name)

This is the number one red flag. Scammers are experts at making an email look official.

• The Trap: The display name says “Microsoft” or “Netflix Support.”
• The Check: Look at the actual email address, not just the name. Hover your mouse over the sender’s name or tap it on mobile to reveal the full address.

A legitimate email from Microsoft will come from an address ending in @microsoft.com. A scammer’s email will be a jumbled mess designed to look similar.

• Real: support@paypal.com
• Fake: paypal.support@secure-login-1a.net or micros0ft-security@outlook.com

If the email address looks weird, it is weird. Delete it.

Step 2: Look for the Emotional “Hook” (Urgency & Fear)

Scammers don’t want you to think. They want you to panic. They create a false sense of urgency to rush you into making a mistake.

Look for these classic emotional triggers:

• Fear: “Your account has been compromised.”
• Urgency: “Action required within 24 hours or your account will be deleted.”
• Greed: “You’ve won a $1,000 gift card!”
• Helpfulness: “Here is the invoice you requested.” (Even if you never requested one).

Real companies don’t operate this way. Your bank will never email you threatening to close your account over an “urgent” link. They will use secure, on-site messages. If it feels like a threat, it’s a test. Don’t fail it.

Step 3: The Hover-Before-You-Click Test (Expose the Real Link)

This is the most important technical skill you can learn. Just like the sender’s address, the links in the email are designed to deceive.

That blue “Sign In Now” button might look like it goes to your bank, but it almost certainly doesn’t.

• On a computer: Hover your mouse cursor over the button or link (DO NOT CLICK). In the bottom corner of your browser, a small box will appear showing you the actual web address it will send you to.
• On a phone: Press and hold the link or button. A menu will pop up showing you the full link preview.

If the link looks suspicious (like bit.ly/3xYqzb or amazon-login.secure-site.xyz), it’s a scam.

Step 4: Spot the “Off” Details (Bad Grammar & Weird Logos)

This is the classic sign, but it’s still surprisingly common. Read the email carefully.

Major corporations like Amazon, Apple, or Google have entire teams of editors. Their emails are flawless. Scammers’ emails, which are often translated or written quickly, are frequently full of mistakes.

Look for:

• Awkward grammar or phrasing (“Your account is in limitation.”)
• Spelling mistakes.
• Logos that look low-quality, pixelated, or just plain wrong.
• A generic greeting like “Dear Valued Customer” instead of your actual name.

These details are the digital “tells” of a con artist.

Step 5: Treat Attachments Like Ticking Bombs

Let’s be crystal clear: Never, ever open an unexpected attachment.

This is the primary way that ransomware (software that locks up your computer and demands money) is spread. Scammers will disguise these files as something harmless:

• Invoice.pdf
• Shipping_Details.zip
• Updated_Policy.docx

Unless you were 100% expecting that specific file from that specific person, do not open it. No legitimate company will send you critical updates in a random .zip file.

---

“Patrol Report: What If I Already Clicked?”

Okay, you clicked. Don’t panic, but act fast.

1. Disconnect: Immediately disconnect your computer from the internet (unplug the ethernet cable or turn off Wi-Fi). This stops the malware from spreading or sending your data.
2. Run a Scan: If you have an antivirus program, run a full system scan. (If you don’t, [see our report on the Best Antivirus Software]).
3. Change Passwords: If you entered your login information on a fake site, go to the real site immediately (by typing the address in yourself) and change your password. Change it on any other site that uses the same password.
4. Freeze Your Credit: If you entered credit card information, call your bank immediately and report the fraud.

The Final Verdict: Trust Is Earned

Your inbox is your digital front door. These 5 steps are your locks, your peephole, and your alarm system. The golden rule of The Secure Patrol is simple: Be skeptical. Trust is earned, and 99% of unsolicited emails haven’t earned it.

When in doubt, don’t click. Just delete.

Stay vigilant.