How to Detect Phishing Emails with Free Tools – A Beginner’s Guide

Phishing emails are one of the most common ways cybercriminals try to steal your personal data, credentials, or money. The good news is that you don’t need an expensive security suite to spot a fake message. In this guide we’ll walk you through a series of free tools and practical techniques that even a complete beginner can use to detect phishing emails before they cause damage.

What You’ll Need

• A modern web browser (Chrome, Firefox, Edge, or Safari)
• Access to your email client (Gmail, Outlook.com, Thunderbird, etc.)
• Free online services: VirusTotal, PhishTank, URLVoid
• Free desktop tools: SpamAssassin (via MailScanner) or Thunderbird with the “Phish Alert” add‑on
• Basic command‑line knowledge (optional, for advanced checks)

Step 1: Verify the Sender’s Email Address

Start with the most obvious clue – the sender’s address. Hover over the displayed name to reveal the full address. Look for subtle misspellings (e.g., “paypa1.com” instead of “paypal.com”) or extra characters. In Gmail, click the three‑dot menu next to the email and select “Show original” to see the raw headers. The “From:” line should match the domain of the organization. If the domain is suspicious, flag the message.

Step 2: Check the Email Headers for Spoofing

Headers reveal the path an email took to reach your inbox. In Outlook.com, open the message, click the three dots, and choose “View message source.” Look for the “Received:” lines – the first entry should be from the organization’s mail server. If you see an unfamiliar IP address or a relay service like “mailgun.org” that the legitimate sender never uses, treat the email as suspicious. Use the free tool MxToolbox Header Analyzer to paste the headers and get a visual breakdown.

Step 3: Scan Links with Free URL Checkers

Phishers love to embed malicious links. Never click directly. Instead, right‑click the link and copy the URL. Paste it into one of these free services:

• VirusTotal – aggregates dozens of scanners. If any engine flags the URL as malicious, avoid it.
• PhishTank – a community‑driven database of known phishing sites.
• URLVoid – checks the domain reputation across multiple blacklists.

For power users, you can use the command line with curl -s https://api.virustotal.com/v3/urls/<url_id> | jq . after obtaining an API key (free tier).

Step 4: Use Free Email Scanners (SpamAssassin via MailScanner)

If you run a personal mail server or use a desktop client like Thunderbird, you can integrate SpamAssassin – a widely used, open‑source spam filter. Install MailScanner (free) which bundles SpamAssassin and provides a web UI. On Ubuntu, run:

sudo apt-get update && sudo apt-get install mailscanner spamassassin

After installation, enable SpamAssassin:

sudo systemctl enable spamassassin && sudo systemctl start spamassassin

MailScanner will automatically tag suspicious messages with “X‑Spam‑Flag: YES” and move them to a quarantine folder. Review the quarantine daily to catch false positives.

Step 5: Enable Built‑In Phishing Protection in Your Email Client

Most major email services already have free anti‑phishing layers. Make sure they are turned on:

• Gmail: Settings → See all settings → General → “Enable phishing detection” (on by default). Also enable “Confidential mode” for sensitive communications.
• Outlook.com: Settings → View all Outlook settings → Mail → Junk email → “Phishing protection” toggle.
• Thunderbird: Install the “Phish Alert” add‑on. It adds a “Report Phishing” button and highlights suspicious links.

These built‑in tools use machine learning to flag suspicious content, but they are not infallible – that’s why the manual steps matter.

Step 6: Test Attachments in a Sandbox Environment

Attachments are another common attack vector. If you receive an unexpected PDF, DOCX, or ZIP, do not open it directly. Instead, upload the file to a free online sandbox like VirusTotal or Hybrid Analysis. Both services will scan the file with multiple antivirus engines and provide a detailed report. For a local sandbox, install VirtualBox and create a disposable VM to open the attachment safely.

Common Mistakes to Avoid

Even seasoned users slip up. Here are the most frequent errors and how to sidestep them:

• Trusting the displayed name: Phishers often spoof the “From” name while keeping the real address hidden. Always inspect the full email address.
• Clicking shortened URLs: Services like bit.ly hide the final destination. Expand them first using unshorten.me before scanning.
• Relying solely on client warnings: Spam filters can miss new threats. Combine automated alerts with manual checks.
• Downloading attachments without scanning: Even if the file looks harmless, scan it first.
• Disabling security extensions for convenience: Keep browser extensions like Netcraft or uBlock Origin enabled; they often block known phishing domains.

Tips and Tricks

Boost your detection game with these extra habits:

• Bookmark phishing‑check tools: Keep VirusTotal, PhishTank, and URLVoid in your browser toolbar for quick access.
• Set up email forwarding rules: In Gmail, create a filter that forwards any message containing “@paypal.com” but not from the official domain to a separate label for review.
• Use a password manager: Managers like Bitwarden auto‑fill credentials only on verified domains, reducing the chance of entering data on a spoof site.
• Enable two‑factor authentication (2FA): Even if a phisher captures your password, 2FA adds an extra barrier.
• Educate your contacts: Share this guide with friends and family; the human element is often the weakest link.

Frequently Asked Questions

Can free tools catch all phishing emails?

No. Free tools provide strong first‑line defense, but sophisticated attacks can bypass them. Combining multiple methods and staying vigilant is essential.

Is it safe to paste suspicious links into online scanners?

Yes. Services like VirusTotal only fetch the URL to analyze it; they do not execute scripts on your machine. However, avoid entering personal credentials into any online tool.

Do I need technical skills to use SpamAssassin?

Basic command‑line familiarity helps, but many front‑ends (MailScanner, SpamAssassin GUI) make configuration point‑and‑click. Follow the installation steps above and you’ll be up and running.

Conclusion

Detecting phishing emails doesn’t require a pricey security suite – a handful of free tools, a systematic approach, and a bit of curiosity are enough to keep your inbox safe. By verifying senders, scanning links and attachments, leveraging built‑in client protections, and avoiding common pitfalls, you’ll dramatically reduce the risk of falling victim to a phishing scam. Remember, the best defense is a habit of double‑checking and staying informed. Happy (and safe) emailing!

Photo by Stephen Phillips – Hostreviews.co.uk on Unsplash