How do I recognise a phishing email?

Key signs: urgent language, sender email doesn't match the claimed organisation, requests for credentials or payment, unexpected attachments, and links that show different URLs when hovered.

Email Security Guide: Protect Your Inbox from Phishing and Hacking

The Biggest Email Threats in 2026

Phishing: Fake emails impersonating trusted organisations (banks, government, popular services) that trick you into revealing credentials or clicking malicious links. 91% of successful data breaches start with a phishing email.

Business Email Compromise (BEC): Attackers spoof or compromise company email to trick employees into transferring money or revealing data. Cost Indian businesses hundreds of crores annually.

Account takeover: Using leaked credentials or phishing to gain access to email accounts, then accessing linked services.

Malware attachments: Emails with malicious documents or executable files that install malware when opened.

Recognising Phishing Emails

Urgency language: "Your account will be suspended in 24 hours" is a red flag. Legitimate companies give notice, not ultimatums.

Sender address mismatch: Display name says "State Bank of India" but actual email is sbi-alert@randomdomain.xyz.

Hover before clicking: Hover over links (do not click) to see the actual URL. Legitimate links should go to the company's real domain.

Grammar and spelling errors: Not universal — sophisticated phishing is well-written — but errors are a flag.

Unexpected attachment: An invoice from a vendor you didn't request, a "failed delivery" notice you weren't expecting.

Securing Your Email Account

Strong unique password: Never reuse your email password. If any other service is breached, attackers try that password on email first.

Two-factor authentication: Email compromise is used to reset every other account. Protect it with an authenticator app, not just SMS.

Recovery options: Verify your recovery email and phone number are current and secure.

Third-party app access: Audit which apps have access to your Gmail/Outlook via Settings → Security → Third-party apps. Revoke access to apps you no longer use.

Safe Email Habits

Never click links in emails for banking and financial accounts. Type the URL directly in your browser.

Never open attachments you were not expecting, even from known senders (their account may be compromised).

Use separate email addresses: Primary (important contacts, banking), Secondary (newsletters and shopping), Throwaway (signups you don't trust).