What Is a Phishing Email? How It Works and How to Check
How phishing emails lead to fake websites and misuse of your information. Check through your usual official app or bookmark, and learn what to do if you already entered details.
“Please check your card payment details.” “We could not deliver your parcel.”
Even when a message looks convincing, judging whether it is genuine from the email alone is difficult.
You do not have to spot every fake. If something needs checking, open the official app you normally use or a saved bookmark, instead of following the email’s link.
How a phishing email leads to harm
A typical phishing attempt follows this sequence:
- An email or text message claims to come from a bank, card issuer, online shop or delivery company.
- A link labelled “Verify,” “Update” or “Log in” takes you to a fake website.
- A familiar-looking screen asks for your user ID, password or card details.
- The information you enter is used for unauthorised access or transactions.
A familiar company name in the sender field does not establish that the message is genuine.
The destination may also use an address or screen that closely resembles the real service. Appearance alone is difficult to judge reliably every time.
The useful habit is to check outside the email itself.
Use a separate route to check
Suppose an email claiming to be from your card issuer asks you to update your payment details.
Something may really need your attention. Even so, you do not need to handle it through the link in that message.
Open the card issuer’s usual official app yourself. For an online order, use your saved bookmark or the shop’s official app to check its status.
Take a route you already use, separate from the one supplied in the email.
Japan’s National Consumer Affairs Center also advises checking through a previously bookmarked genuine website or official app, without opening URLs in emails or text messages.
If you have already opened the link, close the page without entering a user ID, password or card details, or downloading an app.
If you already entered information
If you entered a user ID or password, open the genuine service independently and change your password as soon as possible.
Change it on any other service where you reused the same password too.
If you entered card details or noticed transactions you do not recognise, contact your card issuer or financial institution through its official support channel.
In Japan, you can also seek help from the police or a consumer affairs centre.
Phishing protection does not depend on recognising every suspicious email.
When a message concerns money or passwords, check through your usual official app or genuine website, instead of its link.
This habit can help interrupt the path from a fake email to a fake website.
Supplement: How many phishing reports are there?
The Council of Anti-Phishing Japan received 66,119 phishing reports in July 2026.
These are reports received by the Council, not a count of people who suffered harm.
The figure does not tell us how many victims there were or how much money was lost.
Sources
- National Police Agency, Japan: Phishing countermeasures.
- National Consumer Affairs Center of Japan: Suspect phishing even in emails claiming to come from businesses you regularly use (3 September 2026).
- Council of Anti-Phishing Japan: July 2026 phishing report (published 17 August 2026).
All links lead to external Japanese-language sources, checked on 13 September 2026. English document titles are descriptive translations.