Phishing is one of the most common ways cyberattacks start, and security reports regularly list it among the top causes of breaches and identity theft. Firewalls and antivirus software can't fully stop it, because it targets people rather than systems.
Phishing used to be easy to spot: broken English and a prince offering millions. Today attackers use AI-written text, copies of real company templates and spoofed sender names, and they fool experienced people too.
This guide covers the main types of phishing, the warning signs to look for, what to do if you clicked, and how disposable temporary email reduces how much phishing reaches you.
Understanding the Types of Phishing
Phishing comes in several forms:
- Bulk Phishing (Mass Phishing): Untargeted emails sent to huge lists of addresses. These typically mimic globally recognized consumer brands (such as Netflix, PayPal, Amazon, or Apple) claiming your payment failed or your account was locked.
- Spear Phishing: Targeted attacks aimed at a specific person or organization. Attackers research the victim on LinkedIn, social media, and corporate websites to craft personalized messages referencing real projects, coworkers, or recent purchases.
- Whaling & Business Email Compromise (BEC): Spear phishing aimed at executives or finance staff. The email often masquerades as the CEO or legal counsel demanding an urgent, confidential wire transfer or vendor invoice payment.
- Clone Phishing: Attackers intercept or replicate a legitimate email you previously received, duplicate its exact design and branding, but swap the authentic attachments or links with malicious replicas.
- Smishing & Vishing: Fake text messages (smishing) or phone calls (vishing), sometimes combined with a phishing email to make it more believable.
Phishing doesn't break into computers; it tricks people. Fear, urgency, authority and curiosity are what it relies on.
7 Warning Signs of a Phishing Email
Before you click a link, open an attachment or reply to an unexpected message, check for these:
1. Manufactured Urgency and Threats
Phrases like "Your account will be terminated in 24 hours!", "Unrecognized login from Moscow—verify identity immediately", or "Final notice: unpaid tax invoice" are meant to make you panic and act without thinking. Real services usually give you time and show the same notice when you log in directly.
2. Mismatched Sender Addresses and Display Names
A sender can set any display name they like. While the sender line might read "Apple Support", clicking or hovering over the name reveals the actual envelope address: [email protected] or [email protected]. Always check the domain after the @.
3. Lookalike URLs and Typosquatting
Attackers register domain names that visually mimic legitimate brands (e.g., paypa1.com with the numeral 1 instead of an 'l', or micros0ft-login.com). Hover your cursor over links before clicking to inspect the real URL destination in your browser's bottom status bar.
4. Generic Greetings and Impersonal Salutations
Banks and services you have an account with usually use your name. Greetings like "Dear Customer", "Dear Member" or "Valued User" often point to bulk phishing, although a personal greeting doesn't prove an email is genuine.
5. Suspicious or Unexpected File Attachments
Never open unexpected attachments ending in .exe, .scr, .iso, .zip, .html, or Office documents (.docm, .xlsm) containing macros. Attackers often send HTML attachments that open a fake login page when you double-click them.
6. Unusual Requests for Sensitive Data or Odd Payment Methods
No legitimate bank, IT department, or government agency will ever ask you to email your password, Social Security Number, or 2FA backup codes. A request to pay with cryptocurrency, gift cards or an untraceable wire transfer is a scam.
7. Embedded Tracking and Redirection Scripts
Phishing emails often include tracking pixels to see who opened them. Learn how to block them in our article on what email tracking is and how to stop it.
What to Do If You Clicked a Phishing Link
If you clicked a suspicious link or entered your password on a fake page, do this right away:
- Disconnect immediately: If you downloaded a file or opened an attachment, disconnect from Wi-Fi or Ethernet so any malware can't reach its servers or spread to other devices.
- Change passwords from a secure device: Go to the real website directly, ideally from another device, and change your password to a new, strong one.
- Terminate active sessions: In your security settings, click "Log out of all active devices" or "Revoke active sessions" to sign out anyone who got in.
- Turn on two-factor authentication: use an authenticator app or a hardware key. Read our complete guide to online account security for step-by-step instructions.
- Run an anti-malware scan: Run a full scan with a reputable security tool (like Windows Defender, Malwarebytes, or Bitdefender).
- Notify relevant parties: If work credentials were breached, alert your organization's IT security team immediately. If banking credentials were leaked, call your financial institution to freeze impacted accounts.
How Disposable Email Protects You from Phishing
Nobody can phish an address they don't have. If you use your main address for every forum, trial, shop and discount club, it ends up in breaches and on the lists phishers use.
Using TempoEmails for those signups helps:
- Isolates Untrusted Services: Use a throwaway temporary email for one-off verifications and trials. If the service is breached, attackers only get an address you no longer use.
- No link to you: a temporary address doesn't connect back to your real email, your job or your bank.
- Off the lists: phishing campaigns use the same lists as spammers. Learn how to prevent spam before it starts in our guide on how to avoid spam emails.
How to Report Phishing Emails
Reporting phishing helps get the senders and their sites blocked for everyone:
- Inside your email client: Click the three dots menu and select "Report Phishing" (or "Report Junk").
- To the Anti-Phishing Working Group (APWG): Forward the phishing email as an attachment to
[email protected]. - To the US Federal Trade Commission (FTC): Forward suspicious emails to
[email protected]. - To the spoofed organization: Forward fraudulent emails mimicking brands to their dedicated abuse lines (e.g.,
[email protected]or[email protected]).
Summary
With unexpected emails, a bit of skepticism goes a long way. Always inspect sender domains, never let artificial urgency rush you, and keep your primary address private by using TempoEmails for temporary signups and one-off verification codes.
Explore how disposable email technology functions behind the scenes in our article on how temporary email works, and see the Privacy Policy for how TempoEmails handles your data.