How to spot a phishing email in three seconds
A phishing email is designed to make you act before you think. It may imitate your bank, a delivery company, a government service, a workplace platform or someone you know. The goal is usually to steal passwords, payment details or personal information.
Learning how to spot a phishing email in three seconds does not require technical expertise. A quick scan of the sender, the tone and the requested action can expose many fraudulent messages before you click.
Australians receive plenty of convincing scams through email, SMS and social media. Fake Australia Post delivery notices, MyGov alerts, toll-road messages and bank security warnings are common examples because they match services people use every day.
The safest habit is to pause when a message creates urgency. A real organisation may ask you to sign in, update details or pay an invoice, but it should not force you to follow an unfamiliar link immediately.
Start with the sender
Look at the full email address, not just the display name. “CommBank Security” may appear in the sender field while the actual address uses a strange domain, random numbers or a misspelling. A message from “auspost.com.au” is different from one sent by “auspost-delivery-help.com”.
On a phone, tap the sender’s name to reveal the address. On a computer, hover over it without clicking. Be especially cautious when the domain belongs to a free email service or contains extra words designed to look official.
Read the emotional pressure
Scam messages often use panic as a shortcut. Phrases such as “your account will be closed today”, “final notice” or “payment failed” are intended to stop you checking the facts. A surprise refund or prize can create the same effect through excitement.
Take a breath and ask what the email wants. If it demands an immediate login, gift-card payment, cryptocurrency transfer or identity check, treat it as suspicious. Banks and government departments do not usually ask customers to disclose passwords or one-time security codes by email.
Inspect the link before clicking
A link can look legitimate while leading to a fake login page. Hover over it on a desktop, or press and hold it on a mobile device, to preview the destination. Look for misspelled domains, unusual subdomains, shortened links and long strings of random characters.
The padlock symbol is not proof that a site is genuine. It only indicates that the connection is encrypted. A scammer can also use an encrypted website, so compare the address with the organisation’s known official website and open that site separately instead of following the email link.
Watch for unexpected files
Attachments deserve the same caution as links. An invoice, voicemail, parcel notice or shared document may contain malware or lead to a fake sign-in page. Treat unexpected Word files, PDFs, ZIP folders and HTML attachments carefully, even when the message appears to come from a colleague.
Poor spelling can be a clue, but polished grammar does not guarantee safety. Criminal groups now create professional-looking messages and copy branding accurately. Likewise, a familiar logo or an email thread with copied details can be forged.
Recognise Australian scam patterns
Local context can make a scam feel believable. During tax time, a fake Australian Taxation Office refund message may appear in your inbox. Around Christmas, parcel delivery fraud increases, while messages mentioning MyGov, Medicare, toll accounts or energy rebates can exploit familiar routines.
Australian businesses also face invoice redirection scams. A criminal may impersonate a supplier and ask for bank details to be changed before the next payment. If an email involves money, verify the request using a phone number or contact record you already trust, rather than replying to the message.
News and public affairs can provide another disguise. A dramatic political claim may lead to a malicious survey or donation page, especially during an election campaign. Readers exploring election and policy analysis should apply the same care to links shared in newsletters and social posts.
Verify through a separate channel
If a message might be genuine, do not use its contact details until you have checked them. Find the organisation through a saved bookmark, a printed statement, an official app or a trusted phone number. For a workplace request, speak directly with the person or use an established internal chat.
Never reply with your password, card number, tax file number or verification code. If you have already provided information, contact your bank immediately, change the affected password and report the incident to Scamwatch. If money has moved, speed matters.
For broader online safety habits, practical technology and digital culture coverage can help explain how scams adapt to changing platforms. Still, the most useful protection is a repeatable personal routine rather than relying on any single security tool.
Make the quick check automatic
Use a simple three-part scan: sender, pressure and destination. If the sender is unfamiliar, the language is urgent or the link looks unusual, stop. One warning sign may be a mistake; several together should end the interaction.
Keep software, browsers and security tools updated, and use multi-factor authentication wherever it is available. A password manager can also identify when a login page is using the wrong domain. These measures reduce the damage if a deceptive message gets through.
| Quick clue | Likely phishing signal | Safer response |
|---|---|---|
| Sender | Misspelled or unfamiliar domain | Find the official website yourself |
| Tone | Threats, urgency or unusual rewards | Pause and verify independently |
| Link | Strange address or shortened URL | Do not click; open a trusted app |
| Attachment | Unexpected invoice or document | Confirm with the sender directly |
| Request | Password, code or bank transfer | Refuse and contact the organisation |
Before opening your next email, spend three seconds checking the sender, emotional pressure and destination. Report suspicious messages, warn colleagues or family members, and use official channels whenever money or identity details are involved. A brief pause can protect your accounts, finances and reputation.
