Phishing is the entry vector behind 90% of data breaches. The emails are increasingly convincing — using real logos, correct grammar, and spoofed sender addresses. Spotting them requires knowing exactly which signals to check, not just reading the surface.
The three red flags in the from address
The visible "From" name in your email client can say anything the sender wants. What matters is the actual sending domain hidden beneath it. Always check the raw address, not the display name.
- Domain mismatch — "PayPal Support" sending from
paypal-security@notification-center.com. The display name says PayPal; the domain is not paypal.com. - Lookalike domains — paypa1.com, pay-pal.com, paypal.co (note the missing m). Unicode homoglyph attacks use characters from other alphabets that look identical to Latin letters.
- Subdomain abuse — paypal.com.malicious-domain.ru. The legitimate-looking part (paypal.com) is a subdomain of the real destination (malicious-domain.ru).
What email headers reveal
Email headers are the forensic record of an email's journey from sender to inbox. Three authentication fields tell the truth about whether the sending server was authorized:
- SPF (Sender Policy Framework) — Did the email come from a server the domain owner authorized? SPF: FAIL on a PayPal email means it did not come from PayPal's servers.
- DKIM (DomainKeys Identified Mail) — Is the email content cryptographically signed by the sending domain? DKIM: FAIL means the content may have been tampered with or the signature is forged.
- DMARC — The domain's policy for what to do when SPF or DKIM fails. p=reject means real emails from that domain that fail authentication should be rejected — so any that reach you have already bypassed that policy.
You can analyze the full headers of any suspicious email with our Email Header X-Ray tool — it parses SPF, DKIM, DMARC, and the routing chain automatically.
Link analysis before clicking
- Hover over any link before clicking. The destination URL appears in the bottom of most browsers and email clients.
- Look for redirects — URLs that pass through a redirect service before reaching the actual destination hide the real domain.
- Check the root domain of any link, not just the first part.
secure.account-verify.com/paypal/login— the path says paypal/login but the root domain is account-verify.com. - Use our Domain X-Ray tool to investigate any suspicious domain before visiting it.
Content signals that indicate phishing
- Urgency language — "Your account will be suspended in 24 hours" is a pressure tactic to prevent careful analysis.
- Vague greeting — "Dear Customer" instead of your name suggests a mass-send rather than a message from your actual provider.
- Unsolicited password reset links — If you did not request a reset, you should not be receiving one.
- Unusual sender for the action — Your bank will never ask for your full card number via email. Your IT department will never ask for your password.