Phishing emails have become harder to spot as scammers get better at mimicking real senders, sometimes even passing standard authentication checks. Gmail has a set of built-in tools that can help you catch these attempts before they cause damage, and most of them are already available in your account settings, you just need to know where to look.
Sender verification indicators
Gmail shows visual cues next to a sender’s name to indicate whether an email has passed authentication checks. A verified badge or checkmark generally signals that the sender’s domain has been authenticated, while a question mark icon next to a sender’s name is Gmail’s way of flagging that the email could not be fully verified. If you see this question mark, it is worth checking the sender’s actual email address rather than just the display name, since scammers often use addresses that look similar to a real one at a glance.
Safe Browsing
Safe Browsing works in the background to identify dangerous links inside emails and shows a warning before you are taken to a risky website. This setting is usually enabled by default, so it is worth confirming it has not been turned off, especially if you use a shared or work device.
Security Checkup
Google’s Security Checkup tool reviews your account for weak points, including recent login activity, connected devices and third-party apps that have access to your Gmail account. Running this periodically helps you spot and revoke access for apps you no longer recognise or use, which closes off a common route attackers use to get into an account without needing your password.
Report phishing and blocked senders
Every suspicious email in Gmail can be flagged directly using the “Report phishing” option, which helps Google’s spam filters get better at catching similar attempts in future. Alongside this, blocking a sender outright ensures future emails from that address go straight to spam rather than your inbox.
Two-Step Verification
While not a settings toggle inside the inbox itself, enabling Two-Step Verification on your Google account adds a second layer of protection. Even if a phishing email successfully tricks you into entering your password on a fake page, the attacker would still need the second verification step to actually access your account.