How to Spot a Phishing Email (and What to Do If You Click One)

Phishing emails are designed to look like legitimate communications from banks, HMRC, parcel delivery companies, or online retailers, tricking you into revealing login credentials or personal information. They've become increasingly sophisticated — here's how to spot them.

Red flags in the email itself

Check the sender's actual email address

Hover over the sender name to reveal the real email address. A genuine email from HMRC will come from a @hmrc.gov.uk address — not hmrc-refund@gmail.com or hmrc.gov.uk.refunds@support123.com. Look carefully — criminals use very similar-looking domains (paypa1.com instead of paypal.com).

Generic greetings

Legitimate companies that know you will address you by name. "Dear Customer", "Dear Account Holder", or "Dear User" are phishing red flags.

Urgency and threats

"Your account will be suspended in 24 hours." "Immediate action required." "Your payment has failed." Phishing emails create artificial urgency to stop you thinking carefully before clicking.

Unexpected attachments

Never open an unexpected attachment, even from a known sender whose email may have been compromised. Hover over links to see where they actually lead before clicking.

Emails that commonly impersonate UK organisations

• HMRC — fake tax refunds or overdue payments
• Royal Mail / Evri / DPD — "missed delivery" with a link to pay a fee
• BT / Sky / Virgin Media — account suspension warnings
• Your bank — suspicious activity, update your details
• Amazon / eBay — problem with your order
• NHS — vaccination booking (particularly post-pandemic)

What to do if you've clicked a phishing link

Don't panic. Immediately: disconnect from the internet. If you entered any passwords, change them immediately on another device. If you entered bank details, call your bank. Run a full antivirus scan. If you're not sure whether your device has been compromised, seek professional help.