Phishing is alive and well in 2026, as even with robust antivirus and antimalware protections, the weakest link in the security chain is often the human element. We all make mistakes, skim an email and think it’s probably fine to click that link. But wait! Don’t do it! Phishing scammers rely on you not using due diligence to protect yourself, your data, and your devices with good personal security practices.
The best way to spot phishing emails is to know what to look for. Here’s a list of some of the big phishing red flags which should send you running when you spot them.
Asking for anything
For a scam to be worth doing, the scammers need to make money. For that, they need to get you to send them something of value. That can be in the form of cash, cryptocurrency, or Amazon gift cards, or something they can sell on later, like your passwords or digital identity.
Although friends and family may occasionally ask you for something, they probably aren’t going to do it over Facebook messenger, Email, or a Whatsapp message out of the blue. If you think it might be real, contact that person directly using another method and discuss it with them.
Don’t immediately respond with what they want. Take a pause and think it through first.
Urgency
This is an example of a phishing email that is trying to get the intended victim to respond urgently. Always take a second and consider whether it’s a scam first.
Hooksecurity
The scammers best tool is urgency. Whatever it is they need, they need it RIGHT NOW. You need to respond, quickly. Do it before you stop and think about what they’re actually asking you to do. Do it before you remember to consider demands and urgency with caution and skepticism.
Although this tip is broad and doesn’t specify exactly what the scam might be like, many of them will encourage a swift response from you. Whatever it is the person claims to need, it’s incredibly rare that someone who needs something quickly will email or message you for it. If you’re concerned a digital account may be compromised, it’s still worth taking the time to login through a secure method rather than clicking the link in the email.
Whenever any email asks you to do something with urgency, take a second and consider whether this might be a scam. Look for other signs, and if in doubt, contact the person or organization through a different method that you know is safe and secure and confirm whether the request is legitimate.
Suspicious activity warnings
Suspicious activity warning such as this are often red flags—it’s best to go directly to the source website to check.
Phishing.org
As organizations have improved their digital security, you’ll sometimes get an email warning you that there has been some suspicious activity on your account. Usually this is just you logging into your email account on a new phone or via a different browser. Sometimes it is legitimately someone trying to login to your account without your permission.
But sometimes it’s someone sending you a fake warning. In those cases, they’ll push you to update your login information, or confirm some aspect of your account.
If you think it’s a scam, don’t click on any buttons or links. You can safely delete the email and forget it. If you want to be sure, close the email down and navigate to that site or service using a different tab and login that way. If there’s a problem with your account, you can address it manually yourself.
Spelling and grammar errors
This one is less common in 2026, as just as we all do, scammers have access to Grammarly and ChatGPT—they can easily write convincing sounding emails. Still, for the odd scammer out there still doing the hard work of handwriting phishing scams, they’re not always native English speakers, and their typing skills aren’t as strong as the writers at PCWorld; they make mistakes.
Look for silly typos, odd word ordering, strange sentence structure and other indicators that a person might not be whoever it is they’re claiming to be. You aren’t going to get typos in an email from Amazon claiming your account has been hacked and you need to send half a Bitcoin to fix it.
Also consider emails or messages that are out of character. If you get an email from your boss at 6:45 at night but you know they always clock off at 5:30, trust your gut. Delete. The worst case if you’re wrong is still far better than not trusting your instincts and getting caught out by a scam.
Nefarious buttons and links
It’s usually best to avoid clicking any buttons in an email, and if you’re unsure be sure to check the URL link first before proceeding.
Phishing.org
I make it a habit of not clicking on buttons or links in emails as a matter of course. Sure, that means I often have to take a few extra steps to login to a service that’s emailed me, but I think it’s worth the added security.
You don’t need to go quite that far, but when you are thinking of clicking on a link or button in an email, be sure to check the bottom-left of your browser window. There you’ll see the URL that the button or link is trying to send you to. If it doesn’t line up with the site or service you’re expecting to use, don’t click it.
Odd attachments
After clicking on this attachment, the victim was sent to what looks like a Google login page. A look at the URL bar reveals it’s actually a fake site displayed by local file trying to capture the information for scammers.
Phishing.org
Email attachments are one of the most popular ways for hackers to spread malware, as there’s no real way to guarantee they’re safe before you download them. Some email platforms will automatically scan them for you, but that’s no guarantee either.
If you aren’t expecting an attachment from someone, if they don’t reference it in the email, if the file type or file name looks odd, or if anything else about the email feels off, don’t open it.
If you want to be doubly sure, contact the person who sent it to you using a different communication system and ask them to send you the file over a more secure medium like a cloud service.
Generic or random sender email
Email scams can be sophisticated enough to look like they come from someone you know, but often they don’t change the email it’s sent from. If the email you’ve received claims to be from an official account like Microsoft, Amazon, or Paypal, check the sender email. If it’s a generic Hotmail, Live, Gmail, or other email that technically anyone could have created, delete it. It’s almost certainly a scam.
The same goes for if the email is a random string of numbers and letters. That’s likely set up automatically by the scammers on mass to build out their phishing infrastructure. Your friends, colleagues, and official institutions don’t have emails like that.
Also watch out if you aren’t addressed personally in the email. If it feels generic and unspecific, “Dear sir/madam,” or if they just get your name wrong, be wary. These are other signs the sender might be trying to cast a wide net for their scams.
Spoofed voice not using your password
This one’s not an email phishing scam but it’s still worth looking out for. One of the most nefarious and underhanded scams in recent years has been AI voice spoofing. Like a deepfake, but for a voice, the scammers emulate a loved one’s voice and call you up in a panic, asking for money to solve an immediate problem. The voices can sound almost identical to the real person—especially when you throw in the mild distortion you often get with a phone call.
The combination of urgency and realism can make this a hard phishing attack to spot. The best way to check if it’s real or not, is with a pre-determined password or phrase. Maybe you have a favorite TV show, or a little family motto, or some other secret that is only known to you and your loved ones. Ask them to say it. If the person on the other end of the phone can’t or won’t do it, then you know it’s a scam and can safely hang up and report it to the relevant authorities.
