How to spot phishing in Gmail and Outlook

Phishing email works because it looks ordinary. It arrives in the same inbox as your real mail, in the middle of a busy day, asking for something that seems reasonable. The good news is that most phishing shares a handful of warning signs, and they are the same in Gmail and in Outlook.

Warning signs to look for

None of these proves a message is dangerous on its own. Together, they are a good reason to slow down.

• A sender you do not know, or a familiar name on an unfamiliar address.
• A Reply-To address that does not match the sender.
• A domain that is almost, but not quite, the one you expect: a swapped letter, an added word, a different ending.
• Pressure to act now, or a threat if you do not.
• A request for a password, a code or a sign-in.
• New or changed bank details on an invoice.
• An attachment you were not expecting, or a link whose text does not match where it goes.

Habits that protect you in any email app

• Do not sign in through a link in an email. Open the website yourself instead.
• If a message asks for money or changed payment details, confirm with the sender using a phone number or address you already had.
• Hover over a link to see where it really goes before you click.
• Be careful with attachments you did not ask for, even from someone you know, because their account may have been taken over.
• If something feels off, ask a colleague before you act.

What MiniBrief adds

MiniBrief reads the mailboxes you connect and checks incoming mail the way a security team would. You still make the decisions; MiniBrief makes the signs easier to see.

A risk rating, with reasons

Each incoming message gets a risk rating, with plain-English reasons and short evidence, judged against a baseline built from your own mail: who writes to you, how often, and whether their mail passes authentication. A first contact, a Reply-To that does not match, a request for credentials, pressure to act now, or bank details that differ from what a domain sent before all count. High-risk mail is flagged before you act on it, and you can overturn any verdict.

Links and attachments checked before you open

For the messages a phish usually arrives as, such as money, a sign-in request, an attachment or personal mail from a stranger, links and attachments are judged on the server before you open the message. A high-risk finding is pushed to your browser within minutes, if you have notifications on.

A mailbox audit, on Gmail today

A common sign that an account has been taken over is a filter that forwards, deletes or hides your mail. MiniBrief's mailbox audit checks a Gmail mailbox for filters like these, for forwarding addresses, and for send-as aliases that answer to a different address. A new high-risk finding is pushed to you, and a bad filter can be removed with one click or kept if it is yours.

The mailbox audit works for Gmail today. If you use Outlook, the warning signs and habits above still apply, and so do the risk rating and the link and attachment checks.

Unsubscribe and block that sticks

For senders you simply do not want, one click attempts the sender's one-click unsubscribe and creates a real filter in your mailbox that trashes their future mail. You can undo it under Settings, in Blocked senders.

What to do when a message looks wrong

1. Do not click links or open attachments.
2. Look at the sender address and Reply-To, not just the display name.
3. Check the risk rating and its reasons in MiniBrief, if the message is in your brief.
4. If it claims to be from someone you know, contact them another way.
5. Block the sender if you never want to hear from them again.
6. If you clicked or entered a password, change that password straight away and tell whoever manages your account.

What no tool can promise

MiniBrief sees mail after delivery, on a schedule, and it is not a mail gateway. It is a second pair of eyes, not a guarantee. Your own judgment is still the most important check.

A note on privacy

Message bodies are not stored on our servers. For the details of what MiniBrief reads and keeps, see the Security page at /security.