This phishing email checklist gives you a repeatable way to decide whether a message is suspicious, preserve useful evidence, report it safely, and recover if you clicked, opened an attachment, or shared information. Use the workflow before replying or following any link, then adapt the response to your personal account, workplace, bank, or other service involved.
Overview
A convincing email can imitate a bank, supplier, colleague, delivery company, cloud service, payroll team, or crypto exchange. Sender names, logos, copied signatures, and familiar language are easy to reproduce, so appearance alone is not verification. The safest default is to treat an unexpected request as untrusted until you confirm it through a separate channel.
Phishing is usually designed to make you act quickly. Common requests include signing in through a supplied link, opening an invoice, changing payment details, sharing a security code, buying gift cards, reviewing a document, or approving a login. A message may be a phishing scam even when the underlying brand or account name is genuine; the attacker may simply be impersonating it.
Before investigating, do not click links, open unexpected attachments, reply, forward the message to colleagues, or enter information into a page reached from the email. If you are using a work device, follow your organization's incident-reporting process and avoid deleting the original until security staff advise you.
For a broader verification process covering calls, texts, links, and payment requests, see this online scam checker workflow. If the message concerns a changed vendor bank account or an invoice, use the fake invoice verification guide as a companion checklist.
Checklist by scenario
Scenario 1: You received a suspicious email but did not interact
- Pause. Do not use the contact details, buttons, attachments, or reply address supplied by the message.
- Inspect the full sender address. A display name can be copied. Look for a misspelled domain, an unexpected subdomain, a free mailbox, a reply-to address that differs from the sender, or an address unrelated to the supposed organization.
- Read the request as an attacker would write it. Urgency, secrecy, threats of suspension, unexpected refunds, unusual payment instructions, and requests for passwords or one-time codes are strong warning signs.
- Verify independently. Open the service's known website or app yourself, use a saved bookmark, or contact the person or company through a trusted number. Do not use contact information in the suspicious email.
- Report and quarantine it. Use your mail provider's phishing-report option or your organization's reporting button. Preserve the original message if an administrator or abuse team may need its headers.
Scenario 2: You clicked a link but entered nothing
- Close the tab and do not download anything else from it.
- Record the destination domain, time, device, and what happened. Do not revisit the site merely to take screenshots.
- Run the device's normal security scan and install pending security updates through the device's trusted settings.
- Check browser downloads, extensions, and notifications for anything unexpected. Remove unfamiliar additions only through the browser's normal management controls.
- Report the email and suspicious URL. If it was a work device or account, notify security staff promptly.
Scenario 3: You opened an attachment
Stop interacting with the file. If it requested macros, scripts, permissions, or a password, do not enable them. On a business device, disconnect from the network only if that is consistent with your incident-response policy, then contact the security team. Preserve the file and message for authorized analysis rather than uploading sensitive material to an unknown online scanner.
Scenario 4: You entered a password or security code
- Use a different, trusted device if possible and sign in through the service's known website or app.
- Change the exposed password immediately. Change it anywhere else it was reused, beginning with email and accounts that can reset other accounts.
- End active sessions, review recovery email addresses and phone numbers, remove unfamiliar authentication methods, and check forwarding rules or mailbox delegates.
- Enable multifactor authentication using an available method you trust. Treat any unexpected approval prompts or codes as suspicious.
- Tell the affected provider through an official support channel. If a work account is involved, report it as an incident rather than handling it privately.
Scenario 5: You sent money or shared financial information
Contact the bank, card issuer, payment app, exchange, or other provider using a trusted number or official app. Explain that the transaction may be fraudulent and ask what cancellation, recall, dispute, or account-protection options are available. Save transaction records, the email, recipient details, and relevant timestamps. Do not pay a second person who promises to recover the first payment. For related bank-message scams, review the bank text scam guide.
Scenario 6: You need a ready-to-use report
Use this neutral template for a provider, domain host, or internal security team:
Subject: Suspected phishing message for review
I received a message that appears to impersonate [organization or person]. Received: [date and time, including time zone]. Displayed sender: [name]. Sender address: [full address]. Reply-to address: [address, if different]. Subject: [subject]. Requested action: [brief description]. I did not interact with it / I clicked a link / I opened an attachment / I submitted information. Relevant URL, attachment name, or transaction reference: [details]. The original message and headers are preserved and can be provided through a secure channel.
For a suspected impersonation of a colleague or supplier, verify the request by calling a known number or starting a new conversation rather than replying. Never include a password, full payment-card number, or one-time security code in a report.
What to double-check
Headers and technical indicators
When available, inspect the full message headers or export the original message. Useful evidence can include the actual From and Reply-To fields, received-path information, authentication results, sending infrastructure, URLs, and attachment names or hashes. A header can support investigation, but a single authentication result does not by itself prove that a message is safe. Attackers can use legitimate services, compromised accounts, lookalike domains, or forwarded content.
For links, inspect the destination without opening it. Watch for lookalike spellings, unrelated domains, shortened URLs, encoded or confusing paths, and login pages that do not match the service you intended to use. A padlock or HTTPS connection only describes the connection to the site; it does not establish that the site or sender is trustworthy.
Business payment and account-change requests
Any request to change bank details, redirect a refund, buy gift cards, or bypass normal approval deserves independent verification. Compare it with prior records, but do not assume a familiar thread is safe because an account may have been compromised. Use an established approval process and a second channel. For marketplace or payment-app requests, consult the marketplace and payment app safety checklist.
Workplace containment
Administrators should preserve the original message and relevant indicators before applying broad blocks. Depending on the mail platform, response actions may include searching for matching sender addresses, domains, subjects, URLs, attachment names, or hashes; quarantining matching messages; revoking malicious inbox rules; and checking whether recipients clicked or submitted credentials. Test rules against a narrow sample first, document the change, and avoid blocking a legitimate shared service solely because its name appeared in a phishing email. Use your platform's current documentation for exact syntax and permissions.
Common mistakes
- Replying to ask whether the email is genuine. This confirms that your address is monitored and keeps you in the attacker's conversation.
- Trusting the logo, signature, or familiar thread. These elements can be copied or inserted into a compromised conversation.
- Calling the number in the message. Verify contact details from a known statement, official app, saved contact, or independently typed website.
- Deleting evidence immediately. Report first and preserve the original when it may help an administrator, provider, or investigator.
- Changing only one password. Check reuse, active sessions, recovery settings, forwarding rules, delegated access, and multifactor methods.
- Using an online scanner carelessly. Do not upload confidential attachments, customer data, credentials, or proprietary documents to an unfamiliar tool.
- Assuming a clean antivirus result settles the question. Phishing often relies on social engineering and a fake login page rather than a detectable file.
If you believe personal information was exposed, work through the identity theft protection checklist. If money was lost, the recovery and reporting checklist can help organize next steps.
When to revisit
Keep this playbook available as a recurring reference, not a one-time read. Recheck it before seasonal payment periods, major procurement or payroll cycles, account migrations, and changes to your email provider or security tools. Organizations should review reporting buttons, escalation contacts, mail-flow rules, quarantine procedures, and approved verification channels whenever workflows change.
Refresh local examples after a major phishing campaign, a relevant data breach, a new impersonation pattern, or a change in provider reporting instructions. Screenshots and menu names can become outdated, so confirm them in the current Gmail, Outlook, Apple Mail, bank, exchange, or enterprise-security documentation before publishing internal instructions.
For your next suspicious email, follow this short version: pause, inspect, verify independently, preserve evidence, report, and secure any exposed account. Bookmark this page and keep a plain-text copy of the reporting template with your incident-response materials. That habit reduces rushed decisions when the next message is designed to create urgency.
