To tell if an email is phishing, run seven checks before you click, reply or pay. Look at the sender's real address and where each link goes. Read the warnings Gmail or Outlook already shows, and whether the sender is authenticated. Then weigh the pressure in the wording, any attachment or QR code, and confirm the request another way.
1. Check the sender's real email address
The name at the top of an email is whatever the sender typed. The address behind it is what counts. In Gmail, the address appears next to the name when you have not emailed that person before. The down arrow under the name shows the full details. In Outlook, select More actions, then View, then View message details. The real address sits in angle brackets in the From line.
Read the domain, the part after the @, letter by letter. Lookalike domains are the most common disguise in the attack archive. Milwaukee paid $460,866 after an email from scherrerconstruction.us, where the builder uses .com. Cottage Grove lost $1.28 million to an address that added "inc" to its contractor's domain.
2. Check where a link really goes before you click
On a computer, rest the pointer on a link without clicking. The real address appears at the bottom of the window. Gmail's help says that if the address does not match the link's description, it may lead to a phishing site. On a phone, press and hold the link to see the address instead of tapping it.
Read the domain at the end of the address, not the words at the start. A page at account.microsoft.com.secure-login.example belongs to secure-login.example. A shortened link hides its destination.
3. Read the warnings Gmail and Outlook already show
Both mail services flag some messages for you. Gmail shows a question mark next to the sender's name when it could not authenticate the message. It shows a banner on messages it judges suspicious. A "via" label means a different domain sent the message than the one in the From line.
Outlook shows a question mark on the sender's picture when it cannot verify the sender, and an underlined "via" tag for the same reason as Gmail. On work and school accounts it can also show a line that starts "You don't often get email from", and an External tag on mail from outside the organisation. Your IT team decides whether those appear. A "via" tag alone is not suspicious. A question mark on a sender who never had one deserves a second look.
4. Check if the email is authenticated (SPF, DKIM, DMARC)
Three standards let a receiving server check that a message came from the domain it claims: SPF, DKIM and DMARC. In Gmail on a computer, select More next to Reply, then Show original. Google's developer documentation says the SPF, DKIM and DMARC results each appear on their own line there. In Outlook, View message details shows the full internet headers.
A pass proves that the domain sent the message. It does not prove the domain is honest. A lookalike domain passes every check, because the scammer owns it. A fail on a message that claims to come from your bank is a strong reason to stop.
5. Look for urgency, threats and payment changes
Phishing works by making you act before you think. The UK's National Cyber Security Centre lists the levers: authority, urgency, emotion, scarcity and current events. The US Federal Trade Commission lists the usual stories: suspicious activity on your account, a problem with your payment details, an invoice you don't recognise, a refund you are owed.
Watch for a deadline, a threat, a request for secrecy or a change of bank details. Spelling is no longer a reliable sign. CISA, the US cybersecurity agency, notes that messages written with AI may contain no errors at all.
6. Be careful with attachments and QR codes
An attachment you did not expect is a risk, even from a name you know. Microsoft lists requests to enable macros among the signs of phishing. Its Outlook help describes fake shared documents that ask for your email and password, and fake invoices with locked attachments.
A QR code in an email is a link you cannot read. In a 2023 campaign in this archive, QR codes in fake Microsoft security alerts led to fake Microsoft 365 sign-in pages. If an email asks you to scan a code to sign in, go to the service directly instead.
7. Is this email legit? Confirm it another way
If a message asks you to pay, sign in, change bank details or send information, confirm it through a channel the message did not give you. Call the company on a number you already have. Type its website address yourself. The FBI's Internet Crime Complaint Center advises verifying all payment changes in person or through a known telephone number.
This check covers what the others miss. When an attacker writes from a real, compromised mailbox, the sender and the authentication look perfect. A call to the person you know still reaches the real one.
How to report a phishing email in Gmail and Outlook
Already clicked? Read what to do next. To report, in Gmail on a computer, open the message, select More next to Reply, then Report phishing. In Outlook.com, the new Outlook for Windows and Outlook on the web, select the message, then Report, then Report phishing. In the UK you can also forward a suspicious email to report@phishing.gov.uk. In the US, the FTC asks people to forward phishing emails to reportphishing@apwg.org.
What Antilure draws for a lookalike sender
For a message from a lookalike domain, Antilure draws a banner inside the email in Gmail or Outlook that says the sender's domain imitates a known one, and marks the request to change payment details, without the email leaving your computer. Download Antilure or see the demo.
Sources
- Avoid & report phishing emails, Gmail Help, Google, checked 7 November 2026.
- Check if your Gmail message is authenticated, Gmail Help, Google, checked 7 November 2026.
- Extra info next to sender's name, Gmail Help, Google, checked 7 November 2026.
- Trace an email with its full header, Gmail Help, Google, checked 7 November 2026.
- Security requirements, Gmail, Google for Developers, updated 3 September 2026.
- Phishing and suspicious behavior in Outlook, Microsoft Support, checked 7 November 2026.
- View internet message headers in Outlook, Microsoft Support, checked 7 November 2026.
- Anti-phishing policies in Microsoft 365, Microsoft Learn, updated 20 August 2026.
- How to protect against phishing attacks, Microsoft Learn, updated 2 July 2026.
- Report phishing and suspicious emails in Outlook for admins, Microsoft Learn, updated 3 July 2026.
- How To Recognize and Avoid Phishing Scams, US Federal Trade Commission, September 2022.
- Phishing scams: how to spot and report them, National Cyber Security Centre, reviewed 5 September 2022.
- Report a scam email, National Cyber Security Centre, reviewed 5 September 2022.
- Recognize and Report Phishing, Cybersecurity and Infrastructure Security Agency, archived page.
- Cyber Criminals Conduct Business Email Compromise through Exploitation of Cloud-Based Email Services, FBI Internet Crime Complaint Center, 6 April 2020.