Before you click, pay, download, or share information, judge what the email is asking you to do and verify the sender through a separate, trusted route. A familiar logo, name, or email design does not prove a message is genuine.
What phishing looks like
Phishing is an attempt to steal personal information or gain access to online accounts through deceptive messages or sites that imitate services people already use. Google’s guidance on avoiding and reporting phishing includes emails, messages, ads, and lookalike sites in that definition.
As an Amazon Associate I earn from qualifying purchases.
A phishing email may appear to come from a bank, employer, colleague, friend, or online service. It may ask you to reveal a password or payment details, open a link, download a file, or act quickly to avoid a threatened consequence. The sender’s apparent identity is only a claim; the request and its context deserve scrutiny.
How to check a suspicious email
- Pause over the request. Be especially cautious if the message creates urgency, threatens account closure or another penalty, requests payment or private information, or offers an unexpected reward. Pressure can make a recipient act before checking.
- Inspect the sender address. Compare the full email address with the displayed name. Look for misspellings or a domain that is similar to, but not actually, the organization’s usual domain. Gmail’s sender verification guidance explains how to check message details.
- Preview links without opening them. On a computer, hover over a link to see its destination if your email client supports this. On other devices, use the client’s link-preview feature if available. Be wary when the displayed text and destination do not match, or when the destination is unfamiliar. Do not click simply to find out where it goes.
- Consider warnings and authentication details as clues, not a verdict. Email services may flag suspicious messages or show whether a message passed authentication. Gmail explains that an unauthenticated message means it cannot confirm the apparent sender, but some legitimate mailing-list messages can fail authentication too. Conversely, authentication alone does not prove a message is safe: spammers can authenticate mail.
- Verify the request independently. If the email asks you to act, contact the person or organization using a phone number, app, or website you already know is genuine. Do not use the phone number, reply address, or link supplied in the questionable email.
What to do when an email still looks suspicious
Do not reply, click a link, download an attachment, or enter sensitive information. Report the message using your email provider’s phishing-reporting control. CISA’s 2024 phishing guidance advises: “When in doubt, report it out: If it looks suspicious, it’s best to mark it as ‘junk’ and forward to your IT staff.” At work, follow your organization’s reporting process as well.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Provider warnings and reporting tools can help flag suspicious messages, but they do not replace checking the request or verifying it independently. Gmail also describes built-in phishing detection and 2-Step Verification as protective measures. Multi-factor authentication (MFA) can limit account harm if a password is stolen; it does not make it safe to respond to a deceptive email.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you already clicked, replied, or shared information
Act based on what happened. If you entered a password, go directly to the service’s official website or app—not through the email—and change the password. If you shared payment information or sent money, contact your bank or payment provider through a trusted channel promptly. If you downloaded a file, avoid opening it and use your device’s security guidance to check what to do next. Report the message to your email provider and, if relevant, your workplace IT team.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For a suspicious Google security message, Google recommends visiting your Google Account security page directly and reviewing recent security activity. If you find unfamiliar activity, secure the account and change its password. Google also recommends checking for unknown account delegates, forwarding rules, and filters if you suspect account settings were changed. Other email services may have different controls; use the official security page for your provider.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
