What are common phishing red flags in subject lines?
Urgency and threats
Phishing subject lines often try to scare you into acting fast: 'Your account will be suspended,' 'Immediate action required,' 'Unauthorized login attempt,' or 'Final warning.' They may claim a payment failed or a subscription is expiring. The goal is to bypass your careful thinking.
Legitimate companies do send important notices, but they usually don't use threatening language or demand immediate action via a link. If a subject line makes you panic, that's a red flag. Pause and verify through official channels.
- Urgent or threatening language
- Claims of account suspension or legal action
- Final warnings or deadlines
- Unexpected password reset notices
Too good to be true or oddly generic
Subject lines offering free money, gift cards, refunds, or prizes are common phishing bait. Examples: 'You've won a $500 Amazon gift card,' 'Your refund is ready,' 'Congratulations, you've been selected.' Also be wary of generic greetings like 'Dear Customer' instead of your name, and subject lines that don't quite match the sender's supposed company.
Another red flag is a mismatch between the sender's display name and their actual email address. Hover over or tap the sender name to see the full address. If it's from a free email service (like gmail.com) but claims to be from a bank, it's likely fake.
Spelling, grammar, and strange formatting
Phishing emails often contain spelling errors, awkward phrasing, or unusual punctuation in the subject line. They may use all caps, multiple exclamation points, or odd spacing. While some sophisticated attacks are well-written, many still have telltale mistakes.
Also watch for subject lines that are blank or contain only a random string of characters. These can be attempts to bypass spam filters. If the subject line doesn't make sense for the sender, treat it with suspicion.
- Misspellings or grammatical errors
- ALL CAPS or excessive punctuation
- Blank or nonsensical subject lines
- Sender address doesn't match the display name
Common mistakes
- Assuming a professional-looking subject line means the email is legitimate—phishers can copy real branding.
- Ignoring the sender's actual email address and trusting only the display name.
- Clicking links in urgent subject lines without verifying the sender through a separate channel.
