Spot a Fake Email in 30 Seconds

🎣 What exactly is phishing?

Phishing is an email scam where criminals impersonate a trusted organisation (bank, HMRC, NHS, Amazon...) to steal your login details, passwords or bank details.

🚨 The 7 signs of a phishing email

1. The sender's email address is odd The email seems to come from "support@hmrc.gov.uk" but looking closely, it's "support@hmrc-gov.verification.com". The display name looks right but the actual address is fake. Always check the full address.
2. Artificial urgency or a threat "Your account will be suspended in 24h", "Immediate action required", "Final warning". Legitimate organisations don't threaten you by email.
3. A link that doesn't match the official site Hover over the link (don't click!): does the address shown match the real site? "natwest-secure.com" is not "natwest.com".
4. Spelling mistakes or odd phrasing "Your account have been suspended for security reasons" — this kind of error often reveals automated translation.
5. They're asking for personal information Your bank, HMRC or the NHS will NEVER ask for your password, card number or PIN by email. This is an absolute rule.
6. The email doesn't use your name "Dear Customer", "Dear User", "To whom it may concern"... If your bank emails you, it knows your name and uses it.
7. An unexpected attachment Invoice you weren't expecting, document to sign, "your statement"... Attachments are often malware in disguise. Never open an unexpected attachment.

📧 Real annotated examples

✅ What to do if you receive a suspicious email

• ✓
  Don't click any link — even to check
• ✓
  Don't download attachments
• ✓
  Verify directly on the official site by typing the address manually
• ✓
  Report it — forward to report@phishing.gov.uk
• ✓
  Mark as spam in your email client
• ✗
  Never reply to a suspicious email — even to say you're not interested
• ✗
  Never send passwords or card details by email