Everyday online safety, in plain English · Updated October 2, 2026
An email says your account will close today unless you click a button. Is it real? You do not have to decide while the message is pressuring you.
The quick answer
Pause. Leave the message’s links and attachments alone. Check through a route you already trust. Open the company’s app yourself, use a known bookmark, or call a number from your card or statement.
Watch: Email says your account will close? Check this first.
What is a phishing email?
Phishing is a trick that tries to get you to give away information, send money, or open something harmful. An email may pretend to be from a company or person you trust.
Warning signs worth checking
- Pressure: “Act now,” a threatened account closure, or a reward that supposedly expires immediately.
- An unexpected request: A bill, attachment, or sign-in demand you were not expecting.
- Private information: A request to reply with a password, payment details, or a verification code.
- An odd sender address: The name says one company, but the actual address looks unrelated or misspelled.
These are clues, not a perfect test. A polished message with your name and a familiar logo can still be fake. A familiar sender’s account can also be misused.
See Microsoft’s phishing guidance for more warning signs.
A made-up example
Subject: Your delivery is on hold
“Pay a small fee within one hour or your package will be returned. Use the button below.”
A safer next step: Open the delivery company’s official app or check the order through the store where you bought it. Do not use the email’s payment button to investigate.
This fictional example shows the pattern: an unexpected problem, a deadline, and a request to act through the message.
Check the claim without using the message
- Stop before clicking, replying, scanning a QR code, or calling its number.
- Open the service through a known app, saved bookmark, or address you know is correct.
- Look for the claimed problem in your account, or contact the company through a trusted number.
- If the message appears to come from a friend, confirm through a separate conversation using their usual contact details.
If you do not know the correct address, ask someone you trust to help verify it. The top search result alone is not proof of authenticity.
A verification code belongs in a verified sign-in process you started. Do not read it to someone who contacts you or approve an unexpected sign-in request.
Report it
Use your email service’s Report phishing option when available. In Gmail on a computer, open the message’s More menu beside Reply and choose Report phishing. Avoid its links and attachments while doing this. Menu wording varies by app.
Do not bypass a warning just because the message looks important. For Gmail instructions, see Google’s phishing guide.
What if I already responded?
Stop interacting and take the next step that matches what happened:
- Entered a password: Go directly to the real service, change it, and change it on other accounts where you reused it. Review account security and turn on additional sign-in protection.
- Shared card or bank details, or sent money: Contact the provider promptly using its official contact information.
- Downloaded or opened something suspicious: Update your security software and run a scan. Ask a trusted support provider if you need help.
For U.S. reporting and recovery guidance, use ReportFraud.ftc.gov and IdentityTheft.gov. The FTC’s phishing guide explains these steps.
If someone got into your email: Follow our 10-step hacked-email recovery checklist, including how to check for hidden inbox rules and forwarding.
Keep learning: Browser and website basics · What Is a Download? · More plain-English guides
Did this guide help?
An optional $5 tip helps cover hosting and keeps No Panic Tech’s guides free. No subscription required.
Leave a Reply