Tempx.

How Phishing Emails Work (and How to Spot One)

By Denis · Published 16 Sep 2026. Updated 28 Sep 2026.

Phishing is a trust trick done with mail. The message impersonates someone you already trust (a bank, a delivery company, your own IT department) and asks you to do one small thing: follow a link and log in, confirm a payment, open an attachment. The craft is in making the small thing feel routine, because the moment it feels routine you stop examining it.

Understanding how the trick is built is more durable than memorizing today's examples. The costumes change monthly; the anatomy underneath has barely changed in decades.

The sender is a costume, not a fact

The most important thing to know about the "From" line is that most of it is self-declared. The display name ("PayPal Support", "IT Helpdesk", a name you recognize) is text the sender chose, exactly like the name on a return address label. Mail clients show it prominently and show the actual address only after a tap, which is the gap every phish lives in.

The real address often carries the tell: a lookalike domain. The trick has a whole family, a letter swapped or doubled, a capital I doing duty as an l, an rn pair impersonating an m, or a legitimate-sounding extra word bolted on (security-paypal.example). Read carefully, none of these survive; read at a glance, all of them do.

Authentication standards exist. SPF, DKIM and DMARC let receiving servers check whether the sending server was authorized by the domain in question, and aligned mail is a genuine signal. But the checks validate machinery, not intent: a phisher's own freshly registered lookalike domain passes its own authentication perfectly. The costume being internally consistent is not the same as the costume being true.

The message is engineered to rush you

Below the sender sits the payload, and its design goal is to shrink your deliberation time. The classic levers: urgency ("your account will be suspended in 24 hours"), authority ("per our security policy"), fear ("unusual login detected from another country"), and curiosity or relief ("you have a refund waiting", "your package is held"). Each one converts a decision into a reflex.

The action is always slightly off if you look: a link whose visible text says one thing and whose target is somewhere else entirely; a login page that is a pixel-faithful copy of the real one, served from a domain you have never seen; an attachment with a second extension or a document that demands you "enable content" to view it. None of these are exotic, the whole method depends on them being ordinary enough to pass.

It is worth saying plainly: falling for one is not a character flaw. These messages are built by people who A/B-test human attention for a living, and they only need to work on a busy Tuesday once. The defense is process, not vigilance.

Habits that catch it before the click

The common thread: every habit moves the decision from "does this feel right" to "is this verifiably right", which is exactly the move the message is engineered to prevent.

Where disposable addresses help, and what they can't do

Temporary inboxes reduce phishing pressure at the source: every form that gets a disposable address instead of your real one is a form that cannot later hand your real address to a leak or a list sale. Less circulation of the address means fewer phishes that even know where to find you, and per-sender addresses make the leaker identifiable when mail starts arriving oddly targeted.

They cannot protect an address that already escaped. If your primary inbox is in old breach data, the phishes arrive regardless of how careful your future signups are, that battle is fought with passwords, second factors and the habits above, not with new addresses.

Two honest limits from the tool's own design: a Tempx named inbox is readable by anyone who knows the name, so it is a burner for throwaway signups, never a place for mail that matters; and disposable inboxes exist to receive, not to deceive, using them to impersonate or defraud is against Tempx's terms. For inspecting a suspicious message safely, a disposable box plus the header analyzer and MIME decoder is a reasonable poor-man's sandbox, see what email metadata reveals for how much a header can tell you.

When one arrives anyway

You will get phished at some point, targeted, well-timed, plausible. The playbook is short: don't interact (no clicks, no replies, no "unsubscribe" on anything suspicious), report it through your client's report button or your provider's abuse address so filters learn from it, and if you did interact, change that password everywhere it was reused first, then check the account's sessions and activity. Speed beats embarrassment; the first hour matters more than the story you tell about it later.

And keep the frame: the mail is the lure, not the breach. The breach only happens at the moment you act on it. Everything in this article (reading the true sender, checking the true target, keeping unique passwords and a real second factor) exists to make that moment survivable, even when the lure is very, very good.

If you clicked: the first-hour playbook

Credentials entered on a fake page: change that password at once, everywhere it was reused, then review the account's active sessions and log out anything unfamiliar. Card details entered: the card's fraud line, then the issuer's app to freeze or reissue, speed caps the damage, and issuers handle this daily without drama. Attachment opened: disconnect is unnecessary theater for most lures, but run your platform's malware scan and watch for odd behavior in the following days. A login via a federated button (Google, Apple) on a fake page: revoke that app's access in the provider's security settings and change the password if you typed it anywhere.

Then the two quiet steps people skip: check the recovery paths on the affected account (backup mail and phone are the attacker's next move once inside), and save the phishing message before deleting it, the headers are what a report needs, and your provider's report button uses them. The first hour does not need embarrassment, or a forensic audit of your life. The attack was engineered to work on a busy moment; the response needs to be faster than the attacker's next step.

Teaching the habit to the people you support

For anyone who helps family or colleagues with security: phishing education fails when it teaches fear of links, and works when it teaches two motions. Motion one: on any message that asks for action, expand the sender and read the true address. Motion two: reach the service by your own path (bookmark, app, typed address) instead of the message's button. Those two habits survive costume changes, because they do not depend on recognizing the lure, only on refusing to let the message be the navigator.

The supporting moves: unique passwords via a manager (caps the blast radius), a second factor that is not SMS where possible (caps the stolen-password value), and a standing agreement that "I got a weird email, is this real?" is always a welcome question. The households and teams where that question is cheap are the ones where the fake support call, the fake invoice, and the code-relay scam all fail, because asking became easier than clicking.

Drafted with AI assistance and reviewed against Tempx's editorial rules (no invented statistics, no competitor claims).

Related: What email metadata reveals · The Gmail verification code scam, explained · What a data breach is · How Tempx handles security

Create a temporary email address

Free, instant, no sign-up, messages auto-delete.

Go to your inbox