Online safety, scams and privacy
How to recognise a phishing email
A simple checklist for pausing and checking a suspicious email before taking action.
What you will learn
You'll know common warning signs, how to check a message and when to stop and ask for help.
Before you continue
Stop and seek trusted help if money, account access or personal information may be at risk.
Pause before acting
A suspicious email often tries to rush you. Take time to check it before opening a link or attachment, sending money or sharing information.
Check the request
Look closely at what the message wants you to do. Be cautious if it asks for a password, payment, one-time code or personal information.
Look past the display name
Email apps often show a friendly display name instead of the real address. On a phone, tap the sender's name to reveal the full email address underneath. On a computer, hover over the name without clicking to see the same detail. A mismatched or unfamiliar domain after the @ symbol is a warning sign, even when the display name looks right.
Use the same check before opening a link: hover over it on a computer, or press and hold on a phone, to preview the actual web address before it opens.
Verify it another way
Do not use contact details or links from the message. Open the organisation's official app, type its known website address yourself or use a trusted phone number from another source.
If you already responded
Stop communicating through the message. Contact the relevant bank or account provider using trusted details. From a device you trust, change any passwords that may be affected. Ask for help if you are unsure what information was exposed.
What to expect
You've checked the message without using its links or attachments.
Sources and further reading
- Email scams · Scamwatch
Common warning signs and safer ways to check suspicious email.