How to spot a phishing email

Why it works

Scammers use fear and urgency: "Your account closes in 24 hours", "Suspicious activity on your card", "Your parcel could not be delivered". The goal is to make you click without thinking. If a message makes you panic, stop and check.

Check the sender address

The display name can be faked. An email labelled "Your Bank" may come from a random address. Click or tap the sender's name to see the real address. Does the domain belong to the company, or does it only look similar? Addresses such as "bank-security-team.com" or a swapped-letter lookalike like "paypa1.com" are fake.

Hover over links, do not click

Move the mouse over a link. The real address appears at the bottom left of your browser. On a phone, press and hold the link. If it does not match the text, the link is fake. When in doubt, skip the link. Type the company's address into your browser yourself or open its official app.

Attachments to distrust

• .html and .htm: open as a fake login page.
• .zip, .rar and .iso: can hide malware.
• Macro-enabled Office files (.docm, .xlsm) or any document asking you to "Enable content".
• .exe, .scr, .js: run a program directly.
• QR codes inside an email: your phone opens a fake site when you scan them.

An unexpected invoice or "payment receipt" attachment is especially suspicious.

Common themes in Turkey

Fake e-fatura and invoice reminders, cargo tracking and "address incomplete" notices, bank card and account alerts, e-Devlet and tax refund messages, PTT and customs fees, traffic fine notices. These organisations do not ask you to pay or log in through an email link. If you think a fee is due, check in their official app.

Spelling and greeting clues

A generic greeting such as "Dear customer", poor grammar and odd characters are warning signs. Do not rely on them, though. Modern phishing is often well written and uses real logos. A polished email is not automatically safe.

Quick checklist

1. Was I expecting this email, or is it rushing me?
2. Does the sender's real address match the company's domain?
3. Does the address shown when I hover over the link look right?
4. Is the attachment a risky type, or one I did not expect?
5. Does it ask for a password, card details or a code?
6. If I doubt it, did I check with the company through a number or app I already trust?

What to do if you clicked

Stay calm and work through this in order.

1. From another device, such as your phone, change the password of the affected account. Change it on any other account that uses the same password.
2. Turn on 2-step verification.
3. If you entered card details, call your bank on its official number and have the card blocked.
4. If you opened a file, run a full scan in Windows Security.
5. On the account you typed the password into, check for unknown sign-ins and forwarding rules.

How to report it

In Gmail, open the message, choose the three dots > "Report phishing". In Outlook, choose "Report" > "Phishing". If the email pretends to be your bank, forward it to the bank's official reporting channel. In Turkey, use the bank's own channel. Then delete the email.