A phishing page is a page specifically designed to steal your personal data. While phishing is on the decline because of email filters, lawsuits, and webpage filters, they still do happen. This wikiHow will show you how to identify a phishing page.

Method 1
Method 1 of 2:

In an Email

  1. The email address will almost certainly be a scramble of letters, numbers, and other characters and will certainly not have the domain name of the company that the sender is claiming to represent. [1]
    • This is not a guarantee, though, as it is possible to spoof the "from" address in emails.
  2. Legitimate emails will very rarely, if ever, have typos. However, phishing emails are more prone to typos. Phishing emails are designed to masquerade as a real email from the company. If something does not look right, it’s better to delete the email and check the website yourself than to risk giving away your personal information. [2]
    Advertisement
  3. The links should always point to the company's website. If they don't, then it is likely phishing. To do this, hover your cursor over the site or tap and hold on the URL on mobile. [3]
    • If using Microsoft Outlook with Microsoft 365, depending on your preferences, all links are changed to point to "namXX.safelinks.protection.outlook.com". If you open a bad link with safe links enabled, Outlook will almost always warn you that the URL you are visiting is unsafe.
    • For example, a link to "amazon.com" should not point to "amazon.com.somethingelse.example.com".
    Advertisement
Method 2
Method 2 of 2:

On a Website

  1. To verify that you are not on a phishing page, make sure the domain name is correct. Thanks to machine learning and artificial intelligence, apps like Microsoft Defender and Google Chrome are getting better at spotting phishing websites. If the domain name is not what you expect, then close out the tab. [4]
  2. If you have a virtual machine or an app sandbox, visit the webpage there. A sandbox limits what a program or website can do. A sandboxed window cannot write files to your machine.
    • Windows Pro has a built-in app sandbox, but it must first be enabled. It also has a built-in sandboxed web browser, which also must be enabled. To enable them, turn on the features "Windows Sandbox" and "Microsoft Defender Application Guard" on, then restart your computer.
  3. You can use a fake email address and password to verify the login form. For example, you can use "john@example.com" (a fake email) or the phone number "310-555-1212" (telephone directory assistance) combined with the password "password" to check the domain. If the domain lets you proceed with fake credentials, then the domain probably is fake.
  4. Even for a second, do not paste in your email address, phone number, street address, social security number, or debit/credit card number into any fields. You can use fake personal information generators to check your findings. [5]
  5. This can potentially install malware to your machine. If anything auto-downloads, do not open the file. Instead, delete the installer and report the download to Microsoft or Google.
    Advertisement

Expert Q&A

Search
Add New Question
  • Question
    Why do phishers use bad grammar?
    Mitch Harris
    IT Expert
    Mitch Harris is an IT Expert based in the San Francisco Bay Area. Mitch runs his own IT Consulting company called Mitch the Geek, helping individuals and businesses with home office technology, data security, remote support, and cybersecurity compliance. Mitch earned a BS in Psychology, English, and Physics and graduated Cum Laude from Northern Arizona University.
    IT Expert
    Expert Answer
    It could be a trick to see if you're really paying attention to the email. Most people will notice the poor grammar, feel skeptical, and ignore the scam. However, if a person engages with the scam despite the red flags, the phishers may see them as a good target.
  • Question
    What should you do if you receive a suspicious email?
    Mitch Harris
    IT Expert
    Mitch Harris is an IT Expert based in the San Francisco Bay Area. Mitch runs his own IT Consulting company called Mitch the Geek, helping individuals and businesses with home office technology, data security, remote support, and cybersecurity compliance. Mitch earned a BS in Psychology, English, and Physics and graduated Cum Laude from Northern Arizona University.
    IT Expert
    Expert Answer
    Double-check the sender's address before you do anything else. In a lot of cases, the scammer's email won't line up with with the name they're using in their message.
  • Question
    Should I worry about sextortion emails?
    Mitch Harris
    IT Expert
    Mitch Harris is an IT Expert based in the San Francisco Bay Area. Mitch runs his own IT Consulting company called Mitch the Geek, helping individuals and businesses with home office technology, data security, remote support, and cybersecurity compliance. Mitch earned a BS in Psychology, English, and Physics and graduated Cum Laude from Northern Arizona University.
    IT Expert
    Expert Answer
    Always be skeptical first. In some cases, scammers will attempt to blackmail you by sending a threatening message without any real proof attached. You can assume that the email is bogus if there are no screenshots, pictures, videos, or any other evidence included.
Ask a Question

      Advertisement

      Tips

      Advertisement

      References

      1. Mitch Harris. Consumer Technology Expert. Expert Interview. 16 July 2021.
      2. Mitch Harris. Consumer Technology Expert. Expert Interview. 16 July 2021.
      3. Mitch Harris. Consumer Technology Expert. Expert Interview. 16 July 2021.
      4. Mitch Harris. Consumer Technology Expert. Expert Interview. 16 July 2021.
      5. Mitch Harris. Consumer Technology Expert. Expert Interview. 16 July 2021.

      About this article

      Thanks to all authors for creating a page that has been read 3,191 times.

      Is this article up to date?

      Advertisement