I Opened a Phishing Email. Am I Hacked?

Short answer: probably not. Just opening a phishing email is very unlikely to hack you. The real danger is clicking a link, opening an attachment, or typing in your details. If you did none of those, you can relax and follow the simple steps below.

Why opening it is usually safe

Modern email apps, such as Gmail, Outlook, Apple Mail, and Yahoo, are built to show emails without running anything harmful. They scan messages, block dangerous attachments, and keep the email separate from the rest of your device. That's why security experts agree that simply opening a phishing email rarely causes harm on its own.

The one small thing opening can do

Some scam emails contain tiny hidden images that tell the sender when the email has been opened. That can confirm your email address is real and active, which may mean more scam emails in future. It doesn't give them your password or access to your device. Some senders can also see rough details like your general location or the type of device you use, but that alone is not a hack.

If you only opened it

1. Don't click anything in it, not even "unsubscribe". Unsubscribing in a scam email just confirms your address is active.
2. Report it as phishing or spam in your email app, then delete it. This helps your email provider block similar emails for you and for others.
3. Don't reply, even to say it's a scam.
4. Keep your phone or computer updated. Updates fix the rare security holes that criminals try to use.
5. Watch for follow-ups. Scammers often try again from a different address with a similar story.

If you did more than open it

1. You clicked a link but typed nothing: close the page, run a security scan, and keep an eye on your accounts. The risk is low, but it's worth checking.
2. You typed a password: change it straight away on the real website or app, not through the email. Change it anywhere else you used the same password, and turn on two-step verification.
3. You gave card or bank details: call your bank immediately, using the number on the back of your card.
4. You opened an attachment: disconnect from the internet, run a full security scan, and get help if anything looks wrong.

Where to report it

Use the "report phishing" or "report spam" button in your email app. In the UK, you can also forward scam emails to report@phishing.gov.uk. If the email pretends to be from a real company, such as your bank or a delivery firm, you can tell that company through its official website.

Opening a scam email happens to everyone, often by accident. What matters is what you do next. If you didn't click, download, or type anything, you are almost certainly fine.

Sources: Identity Guard: What happens if you open a phishing email? · UK National Cyber Security Centre: Report a scam email