As of 13 August 2026, AI can only partly check whether an email is a phishing attempt.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Leave the message unopened if possible, and do not click links, open attachments or reply to it.
   2. Open your approved mail client and copy the visible sender address, subject, message text, link text and attachment names without opening any link or file.
   3. Use the mail client's option for viewing raw headers, copy them only if your workplace policy allows it, and remove passwords, tokens and unnecessary personal information.
   4. Paste the copied material into the prompt in an approved chatbot, including your organisation's phishing reporting process if you have it.
   5. Compare the model's evidence against the actual sender domain, the displayed link destinations and the context of the request, without visiting a suspicious destination.
   6. Confirm the decision with your IT or security contact through a separate trusted channel, then use your organisation's reporting or quarantine process and delete the message only when instructed.

   Prompt

   Assess the email below for signs of phishing. Treat this as triage, not proof. Do not open any links, download attachments or claim to have checked live websites, domains, DNS, malware or sender reputation. Use only the text and technical details I provide.
   
   Return:
   1. A classification: likely phishing, suspicious, probably legitimate, or cannot determine.
   2. A confidence level of low, medium or high, with no invented probability.
   3. A table of the specific evidence, quoting the relevant parts of the email and explaining why each point matters.
   4. Any missing evidence that would materially change the assessment, such as raw headers, the real link destination or an attachment analysis.
   5. Safe next actions for a UK workplace, including whether to avoid replying, avoid clicking, report it through the organisation's process and contact the supposed sender through a separate trusted channel.
   6. A short explanation of what you cannot verify from this material.
   
   Do not tell me to test a link by visiting it. Do not ask me to enter credentials. If the email requests payment, password changes, confidential files or an urgent transfer, state that a human security or IT colleague must make the final decision.
   
   Organisation reporting process, if known: [PASTE PROCESS OR WRITE UNKNOWN]
   Email text and visible details:
   [PASTE EMAIL]
   Raw headers, if approved for sharing:
   [PASTE HEADERS OR WRITE NOT AVAILABLE]
   Link text and displayed destinations, copied without opening them:
   [PASTE LINKS OR WRITE NONE]
   Attachment names and file types, without opening them:
   [PASTE ATTACHMENT DETAILS OR WRITE NONE]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.