How to Spot and Report Phishing: Email, SMS, Calls

TL;DR: Phishing is a fake email, text or call that pretends to be a bank, courier, government office or company to steal a password, card detail or OTP. Do not click or reply, and report it: the UK's NCSC and India's CERT-In both run reporting routes. Free tool: Scan My Shadow's digital footprint checker at scanmyshadow.com/digital-footprint-checker.

👉 Use the free digital footprint checker — 30 seconds →

Phishing works because it looks routine: a delivery notice, a billing problem, a bank alert. The message is designed to make you act before you think.

Three main types

Email phishing. Fake billing, account or invoice emails. See the fake ChatGPT billing email and the TV Licence email scam. Targeted versions are covered in CEO fraud emails.
SMS phishing (smishing). Texts about tolls, parcels or KYC with a link. See the unpaid toll text scam.
Voice phishing (vishing). A caller poses as IT support, a bank or an officer, as in the fake IT call scam.

QR codes on posters and flyers are another delivery route; see QR code scams.

How to spot it

Urgency, threats or a deadline.
A sender address or link domain that does not match the real organisation.
A generic greeting instead of your name.
A request for a password, PIN, card detail or OTP.
Unexpected attachments or files.
Odd payment methods such as gift cards or crypto.
Link text that hides a different address; press and hold or hover to see it.

If you already clicked or replied

Change the password from a clean device, then turn on two-factor authentication.
Call your bank if you shared card, UPI or banking details, and check recent activity.
Run a security scan of your phone or laptop if you opened a file.
If an account was taken over, follow what to do when your email is hacked.
If you shared ID documents, see what to do after sharing Aadhaar or PAN.

Spoofing email: how a fake sender address works

Spoofing email, also called spoofing mail or sending a spoofed email, means forging the sender address so a message looks like it came from someone you trust, such as your bank or your boss. It works because basic email does not verify the visible sender. Domains defend with SPF, DKIM and DMARC, and receiving systems use them to flag or reject forgeries. Anyone can try to spoof an email address in the From line, so as a recipient, check the full sender address and reply-to address, look for authentication warnings, and never trust the display name alone. If your own address is being spoofed, your contacts receive junk from "you"; that is not always a hack, but change your password if you see any sign of one.

A related trick is the fake payment scam, where a spoofed payment email, fake receipt or fake payment app makes a seller believe money arrived. Always confirm in your own bank or payment app, never from a screenshot or notification.

Where to report

US: forward phishing emails to reportphishing@apwg.org and report to the FTC at ReportFraud.
UK: forward suspicious emails to report@phishing.gov.uk and texts to 7726.
Canada and Australia: report to the Canadian Anti-Fraud Centre or Scamwatch.
India: file at the cybercrime portal, call 1930 if money was lost, and report incidents to CERT-In.
Any mail app: use its Report phishing option, then delete the message.

Breach notices can also be faked; see what to do about a data breach notification email.

FAQs

What is a phishing email example?

A message that looks like your bank, courier or a subscription service, saying a payment failed or an account will close, with a link to a copycat login page that steals what you type.

How do I report a phishing email?

Use the Report phishing option in your mail app, forward it to your national reporting address such as report@phishing.gov.uk in the UK or reportphishing@apwg.org in the US, and in India report at cybercrime.gov.in or to CERT-In.

What is email spoofing?

Email spoofing is forging the sender address so a message appears to come from a trusted person or company. Domain authentication (SPF, DKIM, DMARC) helps mail systems flag forgeries, but you should still verify sensitive requests through another channel.

Can someone spoof my email address?

Yes, someone can forge your address as the sender without accessing your account. It is a sign of spoofing rather than a hack unless you also see unauthorized logins, so check your account activity and change your password if in doubt.

What is a fake payment scam?

A scam where the victim, often a seller, is shown a fabricated receipt, spoofed payment email or fake payment app so they release goods before real money arrives. Verify the payment in your own bank or payment app.

What is the difference between phishing, smishing and vishing?

Phishing usually means email. Smishing is phishing by SMS or messaging apps. Vishing is voice phishing, where a caller tries to get you to share codes or move money.

How can I tell if a suspicious email is real?

Do not use its links. Open the company's app or type its website address yourself, or call a number printed on your card or official site, and check whether the same notice appears there.

How to tell if an email is spoofed? (email spoofing how to spot it)

A spoofed email sender can look genuine. Check the full sender address and reply-to address, look for authentication warnings, and never trust the display name. If in doubt, contact the sender through another channel.

Before scammers use your details, see them first: check what is already public about you.

Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.

Phishing Explained: How to Spot Fake Emails, Texts and Calls