A phishing email is a fake message designed to trick you into giving away passwords, bank details or personal information. In 2026 they are harder to spot than ever, because scammers now use AI to write flawless English, copy real company branding and target you personally. This guide shows you the exact checks that catch them.
Why phishing is harder to spot in 2026
Phishing used to be easy to spot. Messages arrived full of spelling mistakes, odd grammar and blurry logos. Those days are over. AI writing tools let scammers produce polished emails that read like they came from a real bank, a delivery company or HMRC. Some attacks now use your name, your job title or a recent purchase to look convincing. This is called spear phishing, and it targets individuals instead of blasting thousands of identical messages. The good news is that the structure of a scam has not changed. Every phishing email still needs you to click, download or reply. If you learn the checks below, you can stop almost all of them.
Check the real sender address
Scammers fake the display name, so never trust what appears before the address. Open the full “from” address and read it carefully. A real bank will send from its own domain, for example noreply@yourbank.co.uk. A scammer sends from something that looks close but is not the same. Watch for these tricks:
- Extra words or characters in the domain, such as yourbank-security.com or yourbank.supportdesk.net.
- Lookalike letters, such as “rn” written to look like “m”, or the number 1 swapped for the letter l.
- Free email providers on a “business” email, such as a bank writing from a gmail.com address.
If the address looks wrong, stop there. A genuine organisation will never mind if you verify a message by another route. If you are unsure, find the official phone number or website yourself and contact them directly. Never use the phone number or link printed in the suspicious email.
Inspect links before you click
Most phishing emails push you to click a button or a link. That link leads to a fake login page that steals your credentials. Before you click anything, hover your mouse over the link and look at the address shown in the corner of your browser. On a phone, press and hold the link to preview where it goes. Ask yourself three questions:
- Does the domain match the company it claims to be from?
- Is the web address short and clean, or long and full of odd characters?
- Does it start with https and show the company name you expect?
Be careful with shortened links, because they hide the real destination. If a link looks strange, do not click it. Go to the real website by typing the address yourself. This one habit blocks the most common phishing attack on the internet. For a broader look at staying safe online, read our small business cybersecurity checklist for the UK.
Watch for urgency and unusual requests
Scammers need you to act before you think. Their messages create panic: “Your account will be closed in 24 hours”, “Suspicious activity detected, verify now”, “You owe a penalty, pay today”. Real companies rarely demand instant action by email. Treat any message that rushes you as suspicious by default. Other red flags include requests to move money, buy gift cards, share a one-time code or “confirm” your full password. No legitimate bank or government department asks for these by email. Also watch for odd tone or timing. If a message from your “boss” arrives at midnight asking you to transfer funds urgently, call them instead of replying.
UK-specific scams doing the rounds
UK residents face a set of recurring phishing themes that scammers rotate through the year. Delivery scams pretend to be Royal Mail, DPD or Evri, claiming a parcel needs a small fee or a redelivery booking. HMRC scams threaten tax penalties or promise fake refunds. Banking scams warn of “unusual activity” and link to copycat login pages. Energy and TV licensing scams offer fake discounts or demand overdue payments. AI-powered scams are making these harder to spot, with cloned voices and realistic fake websites adding to the threat. Remember that HMRC never asks for bank details by email or text, and real delivery companies do not ask for payment through links in unsolicited messages.
What to do with a suspected phish
If you think an email is a phishing attempt, do not reply and do not click anything in it. Delete the message after reporting it. In the UK, forward suspicious emails to the National Cyber Security Centre at report@phishing.gov.uk. For scam texts, forward them free to 7726. You can also report scam calls, texts and emails to Report Fraud on 0300 123 2040. If the message pretends to be from your bank, call your bank on the number printed on your card (in the UK you can also call 159 to reach your bank safely). Reporting helps the NCSC take down scam websites and block malicious addresses, which protects other people too.
FAQs
Can phishing emails infect my phone just by opening them?
Opening an email alone almost never infects a device. The danger starts when you click a link, download an attachment or reply with personal details. Keep your phone’s software updated and do not grant apps permissions they do not need.
What is spear phishing?
Spear phishing is a targeted attack aimed at a specific person or company. The scammer researches you first, using your name, workplace or recent activity to make the message believable. It is more convincing than mass phishing but it still shows the same red flags around senders, links and urgency.
The email knew my full name. Does that mean it is real?
Not necessarily. Names, job titles and addresses leak in data breaches and are easy for scammers to buy or scrape. A real name does not prove a message is genuine. Check the sender address and the link destination instead.
What should I do if I already clicked a phishing link?
Act quickly. If you entered a password, change it immediately and turn on two-factor authentication. If you entered bank or card details, call your bank straight away. Run a security scan on your device and report the message to report@phishing.gov.uk.
Are text message scams the same as email phishing?
They use the same tricks. Text scams (smishing) create urgency and include a link or a callback number. The same rules apply: check the sender, never click the link, and forward scam texts to 7726.
The bottom line
Phishing emails in 2026 look professional, personal and convincing, but they still follow the same playbook. Check the real sender address, inspect every link before you click, slow down when a message rushes you, and report anything suspicious to the NCSC. These four habits take seconds and they stop the vast majority of attacks. Staying cautious is not paranoia; it is basic online hygiene.
