How to Prevent Email Phishing: A Practical Guide for 2026

You prevent email phishing with three layers working together: a habit of pausing before you act on any message, account protections such as multi-factor authentication and a password manager, and, for organizations, technical controls like email filtering and DMARC. No single layer is enough. Filters miss messages, and people get tired or rushed. This guide covers each layer, shows how to spot a bad message, and explains what to do in the first hour if you already clicked.

TL;DR

• Pause before you click, reply or open an attachment. Verify urgent requests through a website or phone number you look up yourself, never through details in the message.
• Turn on multi-factor authentication (MFA) everywhere, keep devices updated and use unique passwords, so a stolen password alone is not enough.
• Report phishing, then delete it. Do not click anything in it, including “unsubscribe” links.
• Organizations need layers: filtering, email authentication, phishing-resistant MFA, least-privilege access, training and an incident-response plan.
• If you already clicked, change the affected passwords now, contact your financial institution and watch for unauthorized activity.

Why phishing still works

Phishing succeeds because it targets people, not software. A message arrives that looks like your bank, your boss, a delivery service or your IT department. It creates pressure, and you act before you think. CISA describes defense as behavioral as well as technical: recognize the manipulation, resist the requested action, report it and delete it.

There is also bad news about the old advice. Typos used to give scammers away. CISA now notes that perfect grammar is no longer a reliable sign of safety, because AI tools can produce polished messages. So the habits below focus on what a message asks you to do and where it really comes from, not on how well it is written.

Layer one: how to recognize a phishing email

Most phishing emails share a handful of traits. You do not need all of them to be present. One is enough to slow down.

The red flags

The Government of Canada’s seven red flags of phishing cover the ground well, and CISA’s list overlaps with it. Put together, watch for these:

• Urgency or threats. “Your account will be closed today.” “Payment overdue.” Fear and urgency are designed to short-circuit judgment.
• A request for sensitive data. Passwords, Social Security numbers, card numbers, one-time codes. The FBI says that companies generally do not contact you to ask for your username or password.
• A message you did not expect. An invoice for something you never bought, a package you never ordered, a shared document from someone you barely know.
• A sender address or link that does not match. The display name says your bank, but the domain behind it is something else. The State Department advises calmly checking the sender domain and watching for fear tactics instead of reacting under pressure.
• Shortened or untrusted URLs. CISA lists untrusted shortened links among common indicators. Hover over a link (or press and hold on a phone) to preview where it goes before you tap.
• Unexpected attachments. The FBI recommends never opening unsolicited attachments from unknown senders, and being cautious even with attachments forwarded by others.
• Offers that are too good to be true. Prizes, refunds and gift cards you did not ask for.

A 10-second check before you click

Ask yourself four questions:

1. Was I expecting this message?
2. Does it ask me to click, download, log in, pay or share something?
3. Is it pushing me to hurry?
4. Does the sender’s address match the organization it claims to be?

If the answer to the second question is yes and any other answer feels off, stop. NIST gives the same advice for messages that request a link click, an attachment download, a fund transfer, a login or sensitive information: pause before acting.

What to do with a suspicious message

CISA’s sequence is simple: recognize, resist, report, delete. In practice:

1. Do not click, reply or open attachments. That includes unsubscribe links, which in a phishing email can confirm that your address is live.
2. Verify through a separate channel if it might be real. If the message may concern an account you actually hold, the FTC says to contact the company using a known-real phone number or website. The FBI adds that you should look up the organization’s number independently instead of using contact details supplied by a suspected scammer.
3. Report it. Use your email service’s report-spam or report-phishing button. The FTC also says you can forward phishing emails to reportphishing@apwg.org, forward phishing texts to 7726 (SPAM) and report fraud attempts at ReportFraud.ftc.gov.
4. Delete it. Once reported, remove it so nobody in your household or office opens it later.

A good rule of thumb: never use anything inside the message to check the message. The phone number, the “verify here” button and the reply address all belong to whoever wrote it.

Layer two: protect your accounts and devices

Even careful people slip once. The goal of this layer is that one slip does not become a breach. The FTC’s baseline advice is automatically updated security software on computers and phones, multi-factor authentication on accounts, and backups of computer and phone data. It also notes that spam filters may keep many phishing emails out of your inbox, but extra layers help.

Turn on multi-factor authentication

If a scammer captures your password on a fake login page, MFA is often what stops them from using it. Prioritize email, banking, cloud storage and anything that can reset other passwords. Your email account matters most, because anyone who controls it can reset almost everything else.

Where you have a choice, prefer stronger methods over text-message codes. NIST and CISA both recommend phishing-resistant MFA for organizations, and the same logic applies at home: the fewer codes a human has to read and type, the fewer codes a fake page can capture.

Use unique passwords, and let software enter them

Reused passwords turn one phishing success into many. When one site’s password leaks, attackers try it everywhere else. Our article on why password reuse is dangerous goes deeper on how that plays out.

A password manager helps with phishing in a second, less obvious way. It fills credentials based on the site’s actual address. If you land on a look-alike page, the manager will not recognize it and will not fill anything in, which is a useful warning that something is wrong. The UK’s National Cyber Security Centre lists password managers and single sign-on among the ways to reduce manual password entry, alongside alternatives such as biometrics and smartcards. If you are weighing the safety of storing passwords this way, read are password managers safe and the benefits of using a password manager.

Keep devices and backups current

Malicious attachments and links often rely on known flaws in out-of-date software. Turn on automatic updates for your operating system, browser, phone and security software. Keep backups so that, if an attachment does install ransomware or other malware, you can restore your files instead of paying or losing them.

Limit what you publish

Spammers can harvest any email address posted online. North Carolina’s state IT department suggests avoiding publishing your email address where you can and reading privacy policies to see how your address will be used. A separate address for newsletters, shopping and sign-ups keeps your main inbox cleaner and makes unexpected mail easier to spot.

Layer three: how organizations reduce phishing risk

Training alone will not protect a company, and neither will filters alone. Joint guidance from CISA, the NSA, the FBI and MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One, recommends combining recurring social-engineering training and reporting with email filtering, antivirus or endpoint protection, email authentication such as DMARC, MFA (preferably phishing-resistant) and least-privilege account management, plus an incident-response process.

The UK NCSC reaches the same conclusion from a different direction: because no single control stops every attack, you need several layers, starting with making it hard for attackers to reach your users at all.

A layered checklist

The NCSC specifically recommends restricting privileged access to the minimum necessary, regularly reviewing and revoking unnecessary privileges, removing inactive accounts and reducing password reuse through sensible password policies.

Training that works

Make it short, recurring and tied to a single reporting habit. Employees should know exactly what to do with a suspicious email: use the report button, do not forward it around, and tell IT if they already opened a link or attachment. The joint CISA guidance includes reporting opened emails, links and attachments, and a no-blame culture is what makes people actually do that. Someone who fears punishment will stay quiet for three days, and those three days are when the damage happens.

Handling small-business realities

Small teams often share logins, use personal email for work and have no IT department. Start with the basics: require MFA on email and finance accounts, give everyone a password manager so shared credentials are not pasted into chat, and agree on a rule that any payment-detail change is confirmed by phone using a number already on file. That one rule defeats a large share of invoice and executive-impersonation scams.

Our perspective: where phishing defense usually breaks down

We build password and identity security tools, so we see the same pattern repeatedly. People are told to “be careful,” but nobody makes the careful path the easy one. A person who has 80 accounts, reuses a handful of passwords and has to retype codes all day will eventually enter a credential on the wrong page.

So we focus on removing the decision where possible. A password manager that fills only on the genuine site turns a fake page into a visible mismatch. Passwordless and multi-factor authentication mean a captured password is not the end of the story. Dark web monitoring tells you when a credential has already leaked, so you can change it before someone tries it. None of this replaces judgment, but it means one mistake is less likely to cost you an account.

Our advice is to pick two or three habits and make them automatic: verify urgent requests on a separate channel, never reuse a password and turn on MFA everywhere it is offered. Do those and you have dealt with the bulk of everyday risk.

— Mike

Tools that help you put this into practice

If you want a ready-made way to cover the account-protection layer, we offer plans for individuals, families and teams. For personal use, our password manager plans include Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month, and a free Premium plan at $0.00 per month is listed on our pricing and comparison page. Dark Web Monitoring is $1.67 per month, and Family Dark Web Monitoring is $3.34 per month. For organizations, Teams is $4.00 per month per user and Business is $7.99 per month per user on our business pricing page. Enterprise pricing is not published there.

If you are interested in removing passwords from the login step entirely, see how passwordless MFA works, and use the dark web scan to see whether your email address has already appeared in exposed data.

If you already clicked: the first hour

Mistakes happen to careful people. Speed matters more than embarrassment. NIST’s guidance for after a phishing incident boils down to the steps below.

1. Disconnect if you opened an attachment. If you think malware may have installed, take the device off the network and run your security software. For a work device, tell IT immediately.
2. Change the affected passwords. Start with whatever you typed into the fake page, then any account that shares that password, replacing each with a unique, strong one. Change your email password early, since it controls resets for everything else.
3. Turn on or review MFA on those accounts, and sign out other sessions where the service allows it.
4. Contact your financial institution if you shared card or bank details, and monitor for unauthorized transactions.
5. Report it. Use ReportFraud.ftc.gov and forward the email to reportphishing@apwg.org, as the FTC advises.
6. For organizations: notify the right people under your incident-response plan. If personal data may have been compromised and creates identity-theft risk, NIST says to notify affected parties and check the breach-notification requirements that apply to you.

If you shared a Social Security number or other identity data, consider identity monitoring. Our identity theft protection page explains what we offer.

Common mistakes that undo good defenses

• Trusting the display name. Anyone can set a name like “Your Bank.” Check the address.
• Calling the number in the email. It connects you to the scammer. Look up the number yourself.
• Clicking “unsubscribe” on suspicious mail. Use the report function instead.
• Assuming the email is safe because it is well written. AI has removed that signal.
• Treating MFA as optional on “unimportant” accounts. Low-value accounts often share a password with high-value ones.
• Never practicing the response. Teams that rehearse reporting handle a real incident far better than teams that only read a policy.

FAQ

How can I stop phishing emails from reaching my inbox?

You cannot stop all of them, but you can reduce them. Keep your email provider’s spam filter on, report phishing instead of just deleting it, avoid posting your address publicly and use a separate address for sign-ups. Organizations add email filtering and authentication such as DMARC on top of that.

What is the best defense against phishing emails?

There is no single best defense, which is why guidance from CISA, NIST and the UK NCSC all stress layers. The most effective combination for most people is the pause-and-verify habit, unique passwords and MFA. That way a successful lure still does not hand over your account.

How do I stop a scammer from using my email?

Change your email password to a unique one, turn on MFA and review account recovery options and forwarding rules for anything you did not set up. Sign out of other sessions where possible. If scammers are only spoofing your address, your account may not be compromised at all, but a password change and MFA are still sensible.

What should I do if I clicked a phishing link but entered nothing?

Often the risk is lower, but a link can still lead to malware. Run your security software, keep your system updated and watch for unusual behavior. If you used a work device, tell IT. If you entered a password anywhere, change it right away.

Sources

• Recognize and Report Phishing, CISA
• Phishing, NIST
• Spoofing and Phishing, FBI
• How To Recognize and Avoid Phishing Scams, FTC
• The 7 red flags of phishing, Get Cyber Safe
• Defending Against Phishing Attacks, U.S. Department of State
• Phishing Guidance: Stopping the Attack Cycle at Phase One, CISA and partners
• Phishing attacks: defending your organisation, UK NCSC