How to Spot a Phishing Email — 7 Warning Signs

Phishing emails are the single most common way that hackers steal passwords, install malware, and break into business accounts. The Canadian Anti-Fraud Centre received over 58,000 phishing reports in 2024 — and that's only the ones people actually reported. The real number is much higher.

The good news: once you know what to look for, phishing emails are usually easy to spot. Here are the 7 warning signs we tell every Edmonton client to watch for.

1. The Sender's Email Address Doesn't Match the Company

This is the most reliable sign. The display name might say "Microsoft Support" or "Canada Revenue Agency," but look at the actual email address. A legitimate email from Microsoft will come from a @microsoft.com domain — not support-microsoft@gmail.com, microsoft-helpdesk@outlook.com, or any other variation.

Always click on the sender name to reveal the full email address before trusting any message.

2. There's a Sense of Urgency or Threat

Phishing emails almost always try to pressure you into acting fast. Common tactics include:

• "Your account will be suspended in 24 hours"
• "Unauthorized login detected — verify now"
• "Your tax refund is waiting — claim before it expires"
• "Immediate action required to avoid account closure"

Legitimate companies rarely send emails demanding instant action under threat of losing access. If you feel rushed, that's a red flag. Go directly to the company's website in a new browser tab instead of clicking the email link.

3. The Email Asks for Personal Information

No legitimate bank, government agency, or tech company will ever ask you to confirm your password, SIN, credit card number, or banking details by email. Ever. If an email asks for this information — or directs you to a page that asks for it — treat it as a phishing attempt.

4. Poor Spelling and Grammar

Many phishing emails originate from outside Canada and contain obvious spelling mistakes, awkward phrasing, or sentences that don't quite make sense. Phrases like "Dear Valued Customer" instead of your actual name are also common. Professional companies proofread their communications — sloppy writing is a warning sign.

Note: AI has made some phishing emails much more polished. Don't rely on bad spelling alone to decide whether an email is safe.

5. The Link Destination Doesn't Match the Brand

Phishing emails often link to websites that look identical to the real thing — same logo, same layout, same colours — but the URL is different. Common tricks include:

• Extra words: secure-paypal-login.com instead of paypal.com
• Character substitution: rn instead of m (looks the same in some fonts)
• Completely unrelated domains: paypal.com.verify-account.net

The real domain is the part immediately before the first single slash. In paypal.com.verify-account.net/login, the real domain is verify-account.net — not PayPal.

6. There's an Unexpected Attachment

If you weren't expecting a file, be very careful before opening any attachment — especially .zip, .exe, .docm, or .xlsm files. These can execute code as soon as they're opened. Even a PDF from an unknown sender can contain malicious scripts.

If a colleague or client sends you an unexpected attachment, call or text them to confirm before opening it. Email accounts get compromised, and the message may not actually be from them.

7. Something Just Feels Off

Trust your instincts. If an email makes you feel uneasy — even if you can't pinpoint exactly why — don't click anything. Go directly to the website in question by typing the URL yourself, or call the company using a number from their official website (not the number in the suspicious email).

How to Report Phishing in Canada

You can report phishing emails to the Canadian Anti-Fraud Centre at antifraudcentre.ca or by calling 1-888-495-8501. If the email impersonates the CRA, report it to canada.ca/cra-security.

If you're a business, you should also report it to your IT team or provider so they can block the sender and alert other staff.