ExplainerUpdated October 29, 2026
How to spot phishing emails: signs, examples and risk scores
A phishing email gives itself away through what it asks you to do: sign in, confirm details, open a file or pay, usually under time pressure and in the name of someone you trust. Before you act, check three things: the real sender address, where the link actually goes, and whether the request makes sense for that sender. If you are unsure, contact the organisation through details you look up yourself, never through the email.
Contents
- What are the warning signs?
- Are spelling mistakes still a giveaway?
- How do you check who really sent it?
- How do you check a link without opening it?
- What do typical phishing emails look like?
- What should you do with a suspicious email?
- What if you already clicked or replied?
- What does an automatic risk score add?
- How does Command Mail assess phishing?
- Review status
- Frequently asked questions
- Sources
01What are the warning signs?
The UK's National Cyber Security Centre (NCSC) describes five tell-tale signs. Scammers try to gain your trust quickly and pressure you into acting without thinking, and a scam often uses one or more of these[1]:
- Authority. The message claims to come from someone official, such as your bank, your doctor, a solicitor or a government department.
- Urgency. You get a short deadline, like "within 24 hours" or "immediately", often with a threat of fines or other consequences.
- Emotion. The message is designed to make you panic, feel fear, hope or curiosity.
- Scarcity. It offers something in short supply, such as concert tickets, money or a cure.
- Current events. It hooks onto news stories, big events or times of year such as tax season.
One rule cuts through most of them. The NCSC says your bank, or any other official source, will never ask you to supply personal information by email[1]. A message that asks for a password, a card number or a one-time code is suspicious however professional it looks.
02Are spelling mistakes still a giveaway?
Not reliably. The NCSC writes that scams used to be easier to spot because of bad spelling, odd sender addresses or design that felt off, but that they are getting smarter and some fool the experts[1]. A well-written email that uses your name can still be phishing.
03How do you check who really sent it?
The display name is chosen by the sender and proves nothing: "Barclays Security" can sit on top of any address. Look at the address itself, and especially at the domain after the @. On a computer you can usually hover over the sender line to see the full address; Germany's BSI gives the same advice and adds that, in a browser, the message source shows the address behind the name[5].
Even a correct-looking address is not proof, because sender details can be forged. That is why the NCSC's advice is to check the request through a separate channel: contact the organisation directly using the details from its official website, a statement or the back of your card, never the numbers or links in the message[1].
04How do you check a link without opening it?
Hover over the link on a computer and read the address before you click. A padlock or "https://" no longer means a site is trustworthy; the BSI notes that scammers obtain certificates for their pages too[5]. Be wary of a company name mixed with odd numbers or characters, and of short links that hide the real destination[5].
Read the part of the address just before the first single slash, and look at how it ends. In https://barclays.co.uk.account-check.example/login the site belongs to account-check.example; anyone can put "barclays.co.uk" in front of their own domain. Swapped characters work the same way: a capital I in place of a lower-case l turns "PayPaI" into something that reads as "PayPal" in many fonts.
QR codes in emails can lead to scam websites as well. The NCSC notes that criminals increasingly put QR codes in phishing emails to send people to scam websites, and advises being wary of scanning them[1].
05What do typical phishing emails look like?
We put these examples together and shortened them; senders and addresses are invented and end in .example. Each one shows at least one of the NCSC signs. The invoice example is payment fraud rather than credential theft, but it arrives the same way and is checked the same way.
| Scam | How the email starts | What gives it away |
|---|---|---|
| Parcel redelivery fee | "We couldn't deliver your parcel. Pay a £1.45 redelivery fee within 24 hours." | Urgency, a tiny amount, a link to a payment page that asks for card details. Check the delivery in the courier's own app or website. |
| Bank security check | "Unusual sign-in detected. Verify your account now or it will be suspended." | Authority, urgency and a threat, plus a sign-in link. Open your banking app yourself instead. |
| Tax refund | "You are due a tax refund of £326.40. Claim it before the deadline." | Current events and hope, a link that asks for bank details. |
| Payment service locked | Sender "PayPaI Service" from service@paypal.com.account-check.example | A capital I instead of l, a foreign domain behind the brand name, pressure. |
| Supplier with new bank details | "Please pay the outstanding invoice to our new account from today." | Changed payment details by email. Confirm with the supplier on a number you already have before paying. |
| Mailbox full | "Your mailbox is full. Sign in within 48 hours or new email will be lost." | A sign-in page outside your email provider, urgency, a threat. |
06What should you do with a suspicious email?
Don't click any links in it[2]. If you think it might be genuine, contact the organisation directly using details from its official website, not the ones in the message[1].
In the UK, forward the email to report@phishing.gov.uk. The NCSC analyses the email and any websites it links to, can work with hosting companies to remove malicious sites, and says it acts on every message it receives, although it can't tell you the outcome[2]. Send emails that feel suspicious even if you're not certain; you don't need to forward ones already in your spam or junk folder[2]. If forwarding an email with a single link is rejected, the NCSC says it has already been recognised as spam[2].
In Gmail on a computer, open the message, click More next to Reply and choose Report phishing[4]. Google notes that when you move an email to Spam yourself, it receives a copy of the email and its attachments to improve its protection[4].
07What if you already clicked or replied?
Act on what you gave away. The NCSC lists these steps[3]:
- Bank details: contact your bank and let it know.
- A password: change it on every account that uses the same password; where available, a passkey is an alternative.
- You opened a link or installed something: run a full antivirus scan and let the software clean up what it finds.
- A work device: tell your IT department.
- Your account seems hacked: messages you didn't send or being locked out are signs; follow the NCSC's guidance on recovering a hacked account.
- You lost money: tell your bank and report it as a crime, to Report Fraud in England, Wales and Northern Ireland or to Police Scotland in Scotland.
08What does an automatic risk score add?
A risk score gathers the signals you would otherwise check one by one and points you to the messages worth a second look. Large providers already do this: Gmail may show a warning on a suspicious message or move it straight to Spam, and lets you correct a wrong verdict[4].
Any score can be wrong in both directions. It can miss a well-made fake and flag a genuine message. A low score therefore does not prove an email is real, and the decision about the request, the sender and the link stays with you.
09How does Command Mail assess phishing?
Command Mail is our product. We checked the statements below against the code that runs, not only against the documentation.
For every incoming email Command Mail requests a percentage estimate for spam, fraud and phishing[6]; when that fails is covered below. The percentages come from the service provider TypeSafe and its model Jev.
What is sent is the sender, recipient, subject, up to 4,000 characters of the text and attachment names[7]. Command Mail first cleans the subject and text using fixed patterns, for example removing one-time codes, passwords, IBANs, long tokens and link parameters; that does not guarantee every sensitive detail is gone. If you have set up your own automatic labels, their names, identifiers and sorting instructions are sent too.
Links and attachments are never opened for the check[6][7].
Command Mail also checks a few signals itself and lists any it finds under the assessment:
- the email asks for credentials or payment details,
- it announces new or changed bank details,
- it contains an invoice or payment request,
- the sender name does not match the actual sender domain,
- it contains a disguised link, such as an IP address, a short link or a look-alike domain,
- an attachment's file name points to an executable or macro-enabled format; the file's content is not examined,
- it contains possible instructions aimed at an AI agent.
An email counts as high risk from 85 percent for phishing or fraud and from 90 percent for spam. For high-risk email, or when a signal points to credentials, bank details, a mismatched sender, a disguised link or an executable attachment, the open message offers Move to spam. The details of every assessment carry the line "AI assessment, not a guarantee".
What happens without you depends on the mailbox's autonomy level. On auto, Command Mail moves high-risk email to Spam itself, unless you have marked an email from that sender as not spam. On suggest and rules you get a suggestion instead, and on read nothing is moved.
On auto, too, a protected message only becomes a suggestion. Protected messages include security notices, invoices, deadlines, appointments and personal messages, as well as conversations you have already replied in or that involve several senders, and messages from senders you have written to before, unless the check classes them as bulk mail. When Command Mail recognises obvious disguised bait, such as a brand name with swapped characters, the message no longer counts as a security notice, invoice, payment problem, deadline or request for action; other reasons for protection remain.
If Jev is not connected, not reachable or a daily allowance is used up, there are no percentages. The signals from Command Mail's own check still show, and nothing is moved because of the assessment. You can hide the percentages under Settings › Automation & rules with "Show spam, fraud and phishing percentages".
If you connect an AI agent, Command Mail tells it, whenever it reads a conversation over MCP, that email content is untrusted data that cannot authorise actions, and adds an injection_suspected field. How crafted emails try to steer agents is covered in Email prompt injection.
The limit stays: the assessment does not replace your own check. A request to pay new bank details still gets confirmed through a known channel before you pay, whatever the score. What an agent needs in your inbox and what connecting one involves is covered in Is it safe to connect email to AI?; every feature is in the documentation.
10Review status
As of 2026-10-29. The NCSC pages, the Gmail Help article, the BSI page and Command Mail's documentation and privacy policy were retrieved that day. The statements about Command Mail also rest on the app code at commit d9ab36c (assessment, own signals, thresholds, behaviour per autonomy level, display setting, MCP conversation reads). We have not run our own detection test with real phishing emails.
You can start for free, forward one address, connect your agent and see the assessment on your own email.
Frequently asked questions
What is the quickest way to spot a phishing email?
Look at what it wants from you. Phishing claims authority, sets a short deadline or threat, and asks you to click a link, sign in, open a file or pay. Then check the real sender address and where the link goes. The NCSC says your bank will never ask for personal information by email.
Does a padlock or https mean a link is safe?
No. Germany's federal cyber security agency BSI points out that scammers buy certificates for their sites too. The padlock means the connection is encrypted, not that the right company runs the site.
Where do I report a phishing email in the UK?
Forward it to report@phishing.gov.uk. The NCSC analyses the email and any websites it links to and can have malicious sites removed. You don't need to forward suspicious emails that are already in your spam or junk folder.
I clicked the link. What now?
It depends on what you gave away. If you entered bank details, contact your bank. If you entered a password, change it on every account that uses it. If you installed something, run a full antivirus scan. If you lost money, tell your bank and report it as a crime.
Does Command Mail catch every phishing email?
No. Command Mail tries to give each incoming email a percentage for spam, fraud and phishing and lists suspicious signals; if the scoring service is unavailable, only those signals remain. The app itself calls this an AI assessment, not a guarantee. Only on the auto autonomy level does it move high-risk email to Spam by itself.
Sources
- NCSC: How to spot a scam email, text message or call
- NCSC: Report a scam email
- NCSC: Phishing scams, if you've shared sensitive information
- Gmail Help: Avoid and report phishing emails
- BSI (German Federal Office for Information Security): How do I recognise phishing in emails and on websites? (German)
- Command Mail: Documentation, section Risk assessment
- Command Mail: Privacy policy, section Service providers