Phishing Emails: 10 Warning Signs and What to Do (2026 Guide)

"Your university mailbox is full. Log in within 24 hours or lose your emails." "Your parcel could not be delivered, pay a small fee." "Congratulations, you have been shortlisted for a hotel job in Dubai, just pay the visa charge." Every one of these is a classic example of phishing emails, and students, new graduates and job seekers get more of them than almost anyone.

This guide shows the ten warning signs that government cyber agencies in the US, UK and Australia tell people to look for, what to do in the first hour if you clicked, and where to report a scam in your country. Everything was checked against official guidance on 10 November 2026.

Table of contents

1. What are phishing emails?
2. 10 signs of phishing email scams
3. Phishing email examples students and job seekers get
4. Clicked a link in phishing emails? Do this in the first hour
5. How to report phishing emails in your country
6. Phishing beyond email: texts, WhatsApp and QR codes
7. 5 habits that stop most phishing emails
8. Sources
9. FAQ

What are phishing emails?

Phishing is when criminals pretend to be someone you trust, such as your bank, your college, a delivery firm or a recruiter, to trick you into clicking a harmful link, opening an infected attachment or handing over personal details. The US Cybersecurity and Infrastructure Security Agency (CISA) notes that the same trick also arrives by text, social media message or phone call.

The goal is nearly always one of three things: your password, your money (card details, a bank transfer or gift cards) or access to your device through malware. Phishing emails work because they copy real logos and real language, and because they catch you when you are busy.

10 signs of phishing email scams

Here are the signs of phishing email scams that CISA, the UK's National Cyber Security Centre (NCSC) and Australia's Scamwatch highlight, with the examples students see most:

1. Urgent or threatening language. "Act now", "final warning", "account suspended". Pressure stops you from thinking.
2. Requests for passwords, one-time codes or bank details. Real banks, colleges and tax offices do not ask for these by email. Phishing emails usually ask for your login or card number on a fake page.
3. A sender address that does not match. Look at the actual address, not the display name: support@amaz0n-help.co is not Amazon. CISA gives the example of a misspelled domain like "amaz a n.com".
4. Links that go somewhere else. Hover over a link (or long-press on a phone) to see the real web address. Shortened links you do not trust are a red flag.
5. A generic greeting. Scamwatch warns that emails which do not use your proper name are suspicious.
6. Unexpected attachments. An "invoice", "offer letter" or "fee receipt" you never asked for, especially a zip, HTML or macro-enabled file.
7. Too good to be true. A refund, prize, free laptop or a scholarship you did not apply for.
8. A fee for a job. A hotel or cruise "offer" that asks you to pay for a visa, medical or training first. Genuine employers recruit through registered channels.
9. Payment in gift cards, crypto or to new bank details. No real organisation insists on this.
10. Perfect writing is no longer proof. CISA points out that poor grammar used to be a giveaway, but AI now lets criminals write flawless phishing emails, so check the other signs.

Phishing email examples students and job seekers get

Example	What it wants	Safe response
"Your student email will be deactivated today"	Your college password	Open the college portal yourself; ask the IT help desk
"Tuition fee refund pending, confirm your card"	Card details	Call the finance office using the number on the official site
"Package held at customs, pay $2.99"	Card details, then bigger charges	Track the parcel on the courier's own app
"Hotel job in Dubai, pay visa processing fee"	Money and passport copy	Verify the employer and agent through official channels
"Microsoft 365: unusual sign-in, verify now"	Your Microsoft or Google login	Check security alerts inside your account settings

For job offers abroad, Indian candidates can check a recruiting agent's registration as explained in our sister blog's guide to emigration clearance for Gulf jobs.

Clicked a link in phishing emails? Do this in the first hour

1. Disconnect and do not type anything more. Close the page.
2. Change the password for that account from a trusted device, and for any other account that uses the same password. A password manager makes unique passwords easy.
3. Turn on two-factor authentication. Our two factor authentication guide shows how in ten minutes.
4. Call your bank if you shared card or banking details, and ask them to block the card.
5. Scan your device with built-in security such as Microsoft Defender; see our antivirus for students guide.
6. Check for rules and forwarding. If contacts say they are getting phishing emails sent from your account, look in your mail settings for forwarding rules you did not create, then sign out of all sessions.

How to report phishing emails in your country

Country	Where to report
United Kingdom	Forward to report@phishing.gov.uk (NCSC). If you lost money: Report Fraud (England, Wales, Northern Ireland) on 0300 123 2040, or Police Scotland on 101
United States	Forward to reportphishing@apwg.org; report fraud at ReportFraud.ftc.gov
Canada	Canadian Anti-Fraud Centre online system at reportcyberandfraud.canada.ca, plus local police if you are a victim
Australia	Report to Scamwatch; contact your bank immediately if you paid
India	Call the 1930 helpline for financial fraud and file on cybercrime.gov.in
UAE and Gulf	Use your email provider's "Report phishing" button and report fraud to the police through their official app or website

The NCSC says it had removed 454,800 scam web addresses as of July 2026 thanks to public reports, so a one-minute report really does protect other people.

Phishing beyond email: texts, WhatsApp and QR codes

CISA and Scamwatch both stress that the same tricks now arrive by text message, social media, messaging apps and phone calls. Students often see fake delivery texts, "Hi Mum, I lost my phone" messages, toll or fine notices with a payment link, and QR codes stuck on posters or parking meters that open a fake payment page.

The rules do not change: do not tap links in unexpected messages, never share one-time codes, and check by contacting the organisation or person through a number or app you already trust. If a "friend" asks for money from a new number, call their old number first. Treat these messages with the same suspicion as phishing emails.

5 habits that stop most phishing emails

• Never log in through an email link; open the app or type the address yourself.
• Use a unique password for every account, stored in a password manager.
• Keep two-factor authentication on for email, bank and cloud storage.
• Install updates for your phone, laptop and browser promptly.
• Pause before acting on any message that creates urgency, then verify it another way.

Sources

This guide was checked against these official and reputable sources on 10 November 2026:

• CISA (US Cybersecurity and Infrastructure Security Agency): Recognize and report phishing
• UK National Cyber Security Centre: Phishing scams - how to spot and report them
• UK National Cyber Security Centre: Report a scam email
• Scamwatch (Australian Government): Phishing
• Canadian Anti-Fraud Centre: Report fraud and cybercrime
• APWG: Report phishing
• US Federal Trade Commission: ReportFraud.ftc.gov
• India National Cyber Crime Reporting Portal (helpline 1930)

Photo: Scam phishing fraud email illustration by Mohamed Hassan, CC0, via Wikimedia Commons (cropped).

FAQ: phishing emails

How can you spot a phishing email?

Check the real sender address, hover over links before clicking, and be suspicious of urgency, generic greetings, unexpected attachments and requests for passwords, codes or payment.

What do phishing emails usually ask for?

Most ask you to log in on a fake page, share a one-time code, confirm card or bank details, pay a small fee, or open an attachment that installs malware.

What should I do if I clicked a phishing link?

Close the page, change the password from a trusted device, turn on two-factor authentication, call your bank if you shared financial details, scan your device and report the email.

Can phishing emails have perfect grammar?

Yes. CISA warns that AI tools let criminals write phishing emails with perfect spelling and grammar, so rely on the sender, links and requests instead.

Where do I report phishing emails in the UK?

Forward them to report@phishing.gov.uk, run by the National Cyber Security Centre. If you lost money, report it to Report Fraud or, in Scotland, Police Scotland on 101.

Is it safe to open a phishing email without clicking?

Simply opening an email is usually low risk on an updated device, but do not click links, open attachments, reply or use any unsubscribe link. Report it and delete it.

Read next

• Two factor authentication: set it up in 10 minutes
• Password manager guide: set one up in 30 minutes
• VPN for travel: safe Wi-Fi abroad
• More Cyber Security guides

Work in hotels or restaurants? Hospitality Vacancy lists hotel jobs in India, the Gulf and Europe, and registering is free.

About the author: Sumit Manwal

Sumit Manwal is the founder of Hospitality Vacancy, the job site built for the hotel industry, which he has run since 2017. With more than 20 years of experience in hospitality, he received the Excellence in Hospitality Sector of Uttarakhand award (January 2023) and the Dainik Jagran inext Uttarakhand Ratan award.

He is passionate about helping hotel management students and hospitality professionals build successful careers, and connects talented people with hotel jobs across India, the Gulf and Europe. On Student Tech Desk he writes clear, practical tech guides for students, travellers and hospitality professionals worldwide, so every reader can make confident decisions about their work and life. Every guide links to official sources wherever they exist.