Email Phishing: How to Spot It and What to Do If You Clicked - 2

Do it yourself · free Remove email phishing (fake emails that steal passwords, card numbers or install malware) yourself 5 steps, 15 minutes, no software needed.

Email phishing (fake emails that steal passwords, card numbers or install malware): summary

Facts checked on 27 October 2026 against the FTC page on recognizing and avoiding phishing scams, Microsoft Learn on protecting against phishing (updated August 2026), Google's Gmail help on reporting phishing, Apple Support on phishing messages and fake pop ups, and the Anti-Phishing Working Group trends reports.

We made no request to any address and opened no phishing email; the steps follow those pages and were not tried on a live case.

What email phishing is, and what this guide covers

Email phishing is a fake message sent to many people at once, or to one person on purpose, that looks like it comes from a company or a person you trust. Its goal is to make you hand over something: a password, a card number, a bank login, a one time code, or permission for a file to run on your device.

Microsoft's documentation describes phishing as attempts to steal sensitive information through email, websites, text messages and other electronic communication, written to look like official mail from a real company or person. The stolen details are then used for hacking, identity theft or taking money from bank accounts and cards, and they can also be sold on criminal markets. That description is the one this page follows.

This is not one program and not one website. There is no file called email phishing to uninstall, and no single address behind it. The threat is a method, and the same method shows up under thousands of different sender names, links and attachments.

That changes what a useful guide looks like. Instead of a removal list for one family, you get a way to recognize the message, a clear order of actions for each thing you might have done, and the places to report it.

Our check for this guide was a desk check. We read the Federal Trade Commission, Microsoft, Google, Apple and the Anti-Phishing Working Group on 27 October 2026. We did not open any phishing email, and we do not name any real company as a sender or a victim, because that would need a primary source for each case.

Is a phishing email dangerous, and is opening it enough?

The danger sits in what you do after reading the email, not in reading it. A phishing email that you open and delete usually costs nothing. The harm starts when you click a link, open an attachment, type a password or call a number from the message.

The FTC's advice follows the same line. If the message arrives and you have no account with the company or do not know the sender, treat it as likely phishing, check it against the warning signs, report it and delete it.

If you do have an account there, the company with a phone number or website you already know to be real, not with the details in the message, because links and attachments may install malware.

Mail programs differ in what they load when you open a message. Some load remote pictures, which tells the sender that your address is active. That is a privacy cost, not a break in. If you want to be careful, keep remote images switched off in your mail program until you trust the sender.

A quiet inbox and a clean first look do not prove a message is safe. Attackers change wording, sender names and links daily, and some link destinations show a fake page only to certain visitors. So the rule on this page is behaviour: never trust a message because it looks right, and always verify by a route you chose.

Low You opened the email and did nothing else No action by the sender succeeded. Report and delete the message.

You opened the email and did nothing else

No action by the sender succeeded. Report and delete the message.

Medium You clicked a link but typed nothing The page may have tried to run something in the browser or tell the sender you are real. Close it, update and scan.

You clicked a link but typed nothing

The page may have tried to run something in the browser or tell the sender you are real. Close it, update and scan.

High You opened an attachment or enabled macros A file may have started on the device. Treat it as a possible malware infection and scan at once.

You opened an attachment or enabled macros

A file may have started on the device. Treat it as a possible malware infection and scan at once.

High You entered a password, card or personal details Assume the details are in criminal hands. Change passwords from another device and tell the bank.

You entered a password, card or personal details

Assume the details are in criminal hands. Change passwords from another device and tell the bank.

What email phishing (fake emails that steal passwords, card numbers or install malware) does on an infected PC

How an email phishing attack works, step by step

Almost every phishing email follows four steps: a bait, a click, a fake page or a file, and then the use of what you gave. Knowing the steps lets you stop at the one that is easiest for you.

The bait is the reason to act. The FTC lists the usual themes: a claim of suspicious log in activity or a problem with your account, a payment that failed, an unrecognized invoice, a request to confirm personal or financial details, a refund, or a coupon for free items.

The common thread is a request to click a link and do something quickly. The FTC also notes that real companies do not send links by email or text to update your payment details.

The click leads either to a page or to a file. The page is often a copy of a real sign in screen.

Microsoft warns that the page may look familiar but contain small inconsistencies such as outdated logos or typos, may ask for more information than a real sign in asks for, or may be only an image of a page with a pop up that requests credentials. The file is the other route:

a document that asks you to enable macros

change security settings

install an application

The last step is the use. A password typed into a fake page is passed to the attacker, who can try it on the real service and on other sites where you reused it.

A card number can be charged. Personal details feed identity theft. A file that ran can install malware, which brings its own cleanup.

How to recognize a phishing email: the warning signs

Look at the sender address, the real destination of every link, what the message asks for and how urgent it sounds. Microsoft Learn lists a set of telltale signs, and the FTC adds the common themes. One sign is enough reason to stop and verify.

The sender address is the first check. Attackers use addresses that are close to a real one, with added numbers or changed letters. The name shown in the From line can say anything, so open the full address. Also compare it with the signature: a message signed by one company but sent from an unrelated address is a mismatch.

The links are the second check. Hover over a link with the mouse, or touch and hold it on a phone, and read the real destination. Apple's support page gives the same advice for both Mac and iOS: a link that does not lead to the company's real website is a red flag. If the shown text and the destination differ, do not click.

The request is the third check. A message that asks for a password, a card number or personal details is suspect, because official communication does not usually ask for those by email. A message or an attachment that asks you to enable macros, adjust security settings or install an application is also suspect, because a normal email does not ask for that.

The remaining signs are weaker alone but strong together. The message is unexpected, or comes from someone you rarely deal with. The greeting does not use your name, or uses your email address as a name.

There are many random recipients in the To line. The text has typing or grammar errors or wrong information. Remember that good phishing can have none of these, so a clean message is never proof.

Types of email phishing you may meet

The same trick comes in several shapes: bulk phishing, targeted phishing, messages aimed at money transfers, and messages that use attachments to deliver malware. The checks on this page cover all of them.

Bulk phishing is sent to a very large number of addresses and pretends to be a bank, a payment service, a delivery company, a streaming service or an online shop. The message is generic and the site it points to is a copy of a login page.

The Anti-Phishing Working Group counted 1,003,924 phishing attacks in the first quarter of 2025, its latest quarterly report we could read, the highest quarterly count since late 2023, and said that online payment and banking made up 30.9 percent of all attacks. That shows the scale, not the risk to you in particular.

Targeted phishing uses details one person or company, such as a colleague's name or a real project, to look more believable. At work, the usual request is to pay an invoice, change bank details or a file.

Microsoft's advice for a work computer is to your IT admin and to report the message to your security team. We found no figure for how common targeted attacks are in a source we could read, so we give none.

Attachment phishing hides the danger in a file. Microsoft names the request to enable macros, change security settings or install an application as a warning sign. If the file ran, the case is a possible malware infection, and the steps are in the section what to do if you opened an attachment.

Phishing also arrives by text message, phone call and fake pop ups. The FTC says texts should be forwarded to 7726 (SPAM), not to the email address used for email phishing. Apple's page adds that scammers can spoof a caller ID and create urgency. This guide is email, but the advice to verify by your own route works for all of them.

What we checked for this guide, and what we could not

We read five official pages and did not test any address or open any message. There is no single site behind email phishing, so our usual plain request from the server was not possible: the job named a topic, not an address.

Email phishing · desk check · 27 October 2026

Warning signs Taken from Microsoft Learn (page updated August 2026) and the FTC, and cross checked with Apple Support.

Reporting routes FTC: [email protected] for email, 7726 for texts, ReportFraud.ftc.gov for all. Google: Report phishing in Gmail on a computer. Microsoft: Phishing under Junk in Outlook.com or Report message in Outlook. Apple: [email protected].

Scale of the problem APWG reports 1,003,924 phishing attacks in the first quarter of 2025, the latest edition we could read.

Gmail on a phone Google's page we read gives the steps for a computer only. We do not state steps for the phone app.

Microsoft reporting address Microsoft's page names an older US government address for the working group; the FTC page names [email protected]. We use the FTC's address.

Any real phishing message We opened none and make no claim a particular campaign.

A method, not a program Email phishing is a common and serious way to lose accounts and money, but a message you only read and delete does nothing. What you do after the click decides the damage. This is a desk check, not a test of any one message.

How to remove email phishing (fake emails that steal passwords, card numbers or install malware)

How to remove email phishing

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1 Step 1 : Delete scheduled tasks that bring it back Programs like email phishing add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently. On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete . Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 1 : Delete scheduled tasks that bring it back

Programs like email phishing add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently.

On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete .

Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

2 Step 2 : Remove it from startup Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component. Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check. Full procedure with screenshots: Stop apps from opening at startup On uGetFix

Step 2 : Remove it from startup

Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.

Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.

Full procedure with screenshots: Stop apps from opening at startup On uGetFix

3 Step 3 : Delete the folders left behind Uninstalling often leaves the program's folders, and some threats reinstall themselves from them. Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after email phishing, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too. If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 3 : Delete the folders left behind

Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.

Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after email phishing, its publisher or created on the day the problem started.

Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.

If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

4 Step 4 : Scan the PC, then run the offline scan A scan finds the parts of email phishing that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports. Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running. It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC, then run the offline scan

A scan finds the parts of email phishing that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports.

Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running.

It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

5 Step 5 : Change passwords from another device and sign out other sessions Email phishing can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft. Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules. Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 5 : Change passwords from another device and sign out other sessions

Email phishing can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.

Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.

Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

What to do if you clicked a link, opened a file or typed your details

Match your steps to what you did. Reading only: report and delete. Clicked or opened a file: update security software, scan and remove what it flags. Typed a password or card number: change passwords from another device and call the bank.

2 You clicked a link but typed nothing Close the page. The FTC's advice for a link or attachment that may have installed software is to update your computer's security software, run a scan and remove anything it flags. Do the same for the browser: if a notification request or a download appeared, refuse it and read our guides on browser notifications if one was allowed.

You clicked a link but typed nothing

Close the page. The FTC's advice for a link or attachment that may have installed software is to update your computer's security software, run a scan and remove anything it flags. Do the same for the browser: if a notification request or a download appeared, refuse it and read our guides on browser notifications if one was allowed.

3 You opened an attachment or enabled macros Disconnect from the network if you can, then update your security software and run a full scan. On a work computer, tell your IT admin before you do anything else, as Microsoft advises. If the scan finds something or the computer behaves oddly, use the plan below, and change your passwords from a different, clean device.

You opened an attachment or enabled macros

Disconnect from the network if you can, then update your security software and run a full scan. On a work computer, tell your IT admin before you do anything else, as Microsoft advises. If the scan finds something or the computer behaves oddly, use the plan below, and change your passwords from a different, clean device.

4 You entered a password Change the password at the real site at once, typing its address yourself, and do it from another device if the first may be infected. Microsoft's list says to change all passwords associated with the accounts. Change it on every other site where you used the same password, and turn on multi factor authentication, which the FTC says helps even if a scammer has your password.

You entered a password

Change the password at the real site at once, typing its address yourself, and do it from another device if the first may be infected. Microsoft's list says to change all passwords associated with the accounts. Change it on every other site where you used the same password, and turn on multi factor authentication, which the FTC says helps even if a scammer has your password.

5 You entered a card or bank detail Call your bank or card company using the number on the card or the bank's own website, report the fraudulent activity and ask for the card to be blocked and replaced. Microsoft's list names this step too. Watch your statements for the weeks, because charges can appear later.

You entered a card or bank detail

Call your bank or card company using the number on the card or the bank's own website, report the fraudulent activity and ask for the card to be blocked and replaced. Microsoft's list names this step too. Watch your statements for the weeks, because charges can appear later.

6 You gave personal data such as an ID number In the United States the FTC points to IdentityTheft.gov for steps matched to what you lost, such as Social Security, credit card or bank account numbers. We did not read that site's own steps, so we cannot list them. Outside the United States, use the fraud or identity theft service of your national regulator.

You gave personal data such as an ID number

In the United States the FTC points to IdentityTheft.gov for steps matched to what you lost, such as Social Security, credit card or bank account numbers. We did not read that site's own steps, so we cannot list them. Outside the United States, use the fraud or identity theft service of your national regulator.

7 You called a number or let someone connect remotely If the email gave a phone number and you called, or a caller asked you to install remote control software, treat the device as controlled by someone else. Remove the remote tool in Settings, Apps, Installed apps, change passwords from a clean device and tell the bank. Apple's page notes that scammers can spoof caller IDs and create urgency.

You called a number or let someone connect remotely

If the email gave a phone number and you called, or a caller asked you to install remote control software, treat the device as controlled by someone else. Remove the remote tool in Settings, Apps, Installed apps, change passwords from a clean device and tell the bank. Apple's page notes that scammers can spoof caller IDs and create urgency.

Phishing at work and in your own mailbox

On a work computer, report first to your IT or security team, because a single click can open a way into the company network. They may need the original message, not a screenshot.

Microsoft's guidance says to your IT admin if you are on a work computer, and describes training employees to be wary of any request for personal or financial information and to report the threat to the security operations team immediately.

It also describes tools for organizations, such as mail filtering and Microsoft Defender for Office 365, that help block unsafe attachments and links. Those are tools for administrators, and we did not test them.

If phishing mail comes from a person you know, the sender's account may have been taken over. In that case a on the same thread proves nothing. the person by phone or another channel, and tell them. We found no source that gives a count of how often this happens, so we do not give one.

If you suspect your own mailbox was accessed, change its password from a clean device, turn on multi factor authentication, and check the rules and forwarding settings in the mailbox for entries you did not create. We did not read a vendor page for those paths, so look in your provider's help for the exact names.

After removal: passwords, accounts and prevention

How to report a phishing email

Report the message in your mail program first, then forward it to the Anti-Phishing Working Group, and file a report with the FTC if you are in the United States. Reporting takes a minute and helps providers block the sender for others.

Report with the built in button of your mail program first.

Forward the message as an attachment or in full, so the headers stay.

Tell the real company, through its own website, that someone is using its name.

Tell your IT team at once if it reached a work mailbox.

to the sender or click a link to see what happens.

Forward the message to friends as a joke.

Delete it before you have reported it, if a work policy asks for the sample.

Post the sender's real details or links with a clickable address online.

Because the PC showed A file or program that a phishing email asked you to open or install in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.

Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.

Why the order matters and what to check in each account: secure your accounts after malware .

A report gives you a reference number for your bank and insurer and helps police link cases.

Include the dates, A file or program that a phishing email asked you to open or install in the list of installed apps, any payment details, addresses and phone numbers the attackers used, and screenshots.

In the US, report to the FBI at ic3.gov and scams to ReportFraud.ftc.gov. In the UK, use Report Fraud (reportfraud.police.uk); in Canada, the Canadian Anti-Fraud Centre; in Australia, ReportCyber at cyber.gov.au. EU residents report to their national police: Report a cyber attack or scam to the authorities .

Every agency, with what to send and when businesses must notify regulators, is listed in where to report cybercrime by country .

How to protect yourself from email phishing

Turn on multi factor authentication on email, bank and shopping accounts, as the FTC advises.

Keep security software and the operating system on automatic updates, on the computer and the phone.

Go to a company's site by typing its address or using your own bookmark, never through a link in a message.

Use a different password for every account, with a password manager if you like.

Back up the computer and phone to an external drive or the cloud, as the FTC advises.

Hover over every link and read the sender address in full before you act.

Enable macros or install an application because an email asks you to.

Send passwords, one time codes or card numbers by email, text or phone.

Trust a message because it uses a real logo or your name.

Call a number printed in the suspicious message.

Disable security features because someone asks you to; Apple says it never asks that.

Questions email phishing (fake emails that steal passwords, card numbers or install malware)

What is email phishing?

Email phishing is a fake message that pretends to come from a bank, shop, service or person you know, so that you click a link, open a file or type a password.

Microsoft describes phishing as attempts to steal sensitive information through email, websites, text messages and other electronic communication that imitate real senders. It is a method, not a program, so there is nothing to uninstall. The danger lies in what you do after you read the message.

How can I tell if an email is phishing?

Check the sender address in full, hover over each link to read the real destination, and look at what the message asks for.

Microsoft lists these signs: links that point elsewhere than they say, requests for personal or financial information, look alike addresses, unexpected messages, requests to enable macros or install software, errors, a mismatch between sender and signature, and a generic greeting.

The FTC adds themes such as suspicious login claims and unrecognized invoices. One sign is reason enough to verify by your own route.

What should I do if I clicked a link in a phishing email?

Close the page and type nothing on it. The FTC says that if a link or attachment may have installed software, you should update your computer's security software, run a scan and remove anything it flags.

If the page showed a sign in form and you used it, change that password at once from another device, turn on multi factor authentication and change the password anywhere else you reused it. Report the message afterwards.

Can I get a virus just by opening a phishing email?

Opening and reading an email is usually not enough for a break in, and we found no source on this page that says otherwise. The risk comes with a link or an attachment.

Microsoft names requests to enable macros, change security settings or install an application as warning signs, and the FTC says links and attachments may install malware. Keep your mail program and system updated, and do not open files you did not expect.

What if I entered my password or card details?

Assume the details are in the wrong hands. Change the password at the real site, typing its address yourself, and on any other site where you used it.

Microsoft's list adds reporting fraudulent activity to your bank and card company, so call them using the number on the card. In the United States the FTC points to IdentityTheft.gov for steps matched to what was exposed. Turn on multi factor authentication and watch your statements.

How do I report a phishing email?

Use the report button in your mail program first:

Report phishing in Gmail on a computer

Phishing under Junk in Outlook.com

Report message in Outlook

Then forward the email to the Anti-Phishing Working Group at [email protected], as the FTC advises, and report it at ReportFraud.ftc.gov if you are in the United States. Text messages go to 7726 (SPAM) instead. At work, tell your IT or security team first.

Is the email from my bank or a company I use real?

Do not judge by the message. The FTC's advice is to the company with a phone number or website you know is real, not the details in the email.

Legitimate companies do not send links by email or text to update your payment details. Type the company's address yourself or use your own bookmark, sign in there and see whether there is any notice. If there is none, the message was almost certainly phishing.

Does an antivirus or a spam filter stop phishing emails?

They help but do not stop everything. Filters block many messages, and the FTC advises security software with automatic updates, yet new messages and look alike pages appear daily, and some reach the inbox.

We did not test any product against phishing, and we make no claim that any tool catches all of it. Treat the filter as a second line and keep the habit of checking sender, link and request.

What is the difference between phishing, spam and a scam email?

Spam is unwanted bulk mail, usually advertising. Phishing is a deceptive message that tries to get your details or a click by imitating someone you trust.

A scam email is a wider term that also covers lotteries, romance and advance fee schemes that do not need a fake login page. A phishing message can be spam as well. The steps are the same:

verify through your own route

Will Fortect remove email phishing?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For email phishing, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

FTC Consumer Advice: How to recognize and avoid phishing scams ( read October 27, 2026 )

Microsoft Learn: How to protect against phishing attacks ( read October 27, 2026 )

Google Help: Report phishing in Gmail ( read October 27, 2026 )

Apple Support: Recognize and avoid phishing messages, phony support calls and other scams ( read October 27, 2026 )

Anti-Phishing Working Group: Phishing Activity Trends Reports ( read October 27, 2026 )