Phishing emails succeed not because they are flawless but because they arrive at busy moments and ask for thirty careless seconds. The defence is a routine that fits inside one minute: sender, links, language, request. Learn how to spot a phishing email as a sequence of checks rather than a vibe, and the vast majority of attacks — including the polished modern ones with perfect logos and grammar — reveal themselves before your finger reaches the link.
Check One (15 seconds): the Sender’s REAL Address
The display name is theatre — anyone can write “PayPal Support” or your CEO’s name in it. The address underneath is the evidence. Expand it and read the domain character by character: support@paypa1.com, billing@yourbank-secure.net and hr@yourcompany-mail.com are all strangers wearing familiar coats. Attackers register lookalike domains precisely because glances slide over them; your job is the unglancing read, letter by letter, especially after the @. On phones, where clients hide addresses behind names, tap to reveal before judging anything else. A message from a free webmail address claiming to be your bank, employer or a government department fails this check instantly, as does any “internal” request arriving from outside the company domain. Fifteen seconds, most fakes dead already.
Check Two (20 seconds): Links and Attachments, Hovered Not Clicked
Every phishing email carries a payload: a link to a credential-harvesting page or an attachment with malware inside. Inspect before contact. On a computer, hover the mouse over links and buttons and read the true destination in the corner — the sentence “click here to verify” may sit on a link to a domain that shares nothing with the claimed sender. On a phone, long-press for the preview. Attachments demand the same suspicion with extra rules: invoices, “voicemails”, delivery notes and HR documents you were not expecting are the classic carriers, and file types that can run code (executables, macro documents, disk images, HTML files) from an email should essentially never be opened at all. When the message survives both checks but something still feels angled, the professional move is the side door: ignore the email’s links entirely, open the service’s real app or type its address yourself, and see whether the claimed issue exists there. It almost never does. The same verification habit protects your gadget accounts too — the companion piece on drone flying rules for beginners makes the matching point for the skies: check the official source before acting on an exciting instruction.
Check Three (15 seconds): the Emotional Engineering
Phishing is theatre with a script, and the script has recurring characters: urgency (“your account closes in 24 hours”), fear (“suspicious login — was this you?”), greed (“tax refund waiting”), authority (“the CEO needs gift cards, discreetly”) and curiosity (“your parcel/photo/document”). Legitimate organisations occasionally use deadlines; attackers ALWAYS use pressure, because pressure’s function is to make you skip checks one and two. Treat emotional spike as evidence: the more an email wants you hurried, secretive or afraid, the slower you should go. Modern spear-phishing, written with AI and fed on social media, can personalise the script — your real manager’s name, a real project, a plausible invoice — which is precisely why the defence is procedural rather than perceptual: addresses, destinations and out-of-band verification catch what “this looks genuine” cannot.
The Polished Phish: When Grammar and Logos Look Perfect
The oldest advice — “look for spelling mistakes” — is now dangerously stale. Current phishing kits copy the real brand’s HTML wholesale, write flawless prose with AI assistance, and increasingly arrive in thread replies to genuine conversations, inheriting trust from the messages above them. Against these, surface quality is evidence of nothing. The checks that still bite are structural: the sender domain and the link destination cannot be faked cheaply at scale, which is why they anchor the routine; a padlock on the destination page means only that the FAKE site also bought a certificate; and any page that asks for a password you reached BY EMAIL should be closed and re-entered through the app, no matter how perfect it looks. Anchor on what the attacker cannot counterfeit — your own bookmarks, your own phone numbers, the address you typed — and let visual polish impress you somewhere safer.
Check Four (10 seconds): Verify the Request Out of Band
When a message asks for money, credentials, data or secrecy, the deciding test happens outside the email. Call the sender on a number you already trust (not one printed in the suspicious message), message them on a different channel, or walk to their desk. Thirty seconds of mild social awkwardness is the cheapest fraud insurance in existence, and organisations with a culture of verifying payment changes lose dramatically less to invoice fraud. For account alerts, the side-door rule covers it: your own bookmark or app, never their link. And when you confirm a phish, do the small civic acts: report it with your mail client’s phishing button (which trains filters for everyone), warn the impersonated team if it targeted your workplace, and delete it. If you already clicked or entered credentials: change that password from a clean device, turn on two-factor authentication, check the account’s recovery settings and active sessions, and tell your IT or bank promptly — early reports genuinely limit damage, and shame is the attacker’s ally, not yours.
The One-Minute Habit
Sender address, link destination, emotional script, out-of-band verification — four checks, sixty seconds, applicable to texts and direct messages as much as email (the same scripts arrive by SMS and WhatsApp daily). Teach it at home the way you would teach road safety, because children’s and parents’ inboxes are targeted with the same kits aimed at banks. Knowing how to spot a phishing email will not make the attempts stop — nothing will — but it moves you permanently out of the attacker’s business model, which depends entirely on people who act inside the first careless minute. Spend that minute on the checks instead, and the message is just mail again: read, judged, and safely ignored.
