Phishing is still the easiest way into the digital life of a person or a business. It doesn't take a sophisticated attack: a believable message that convinces someone to type a password into a fake page or open an attachment is enough. The good news is that almost every phishing email leaves recognisable traces, as long as you know where to look.
Why phishing still works
Whoever writes a scam email isn't betting on technology but on behaviour. They pull three very human levers: urgency ("your account will be suspended within 24 hours"), authority ("accounts department", "your bank", "courier") and curiosity ("a document has been shared with you"). When one of these levers is pulled, we tend to skip the checks we would make with a clear head. So the first piece of advice is about mindset: an email that pressures you deserves more attention, not less.
The signs to check, one by one
1. The real sender
The display name can be anything: "Customer Service" means nothing. What matters is the full address after the @ sign. Be wary of domains that imitate genuine ones with small variations: swapped letters, extra hyphens, unusual extensions, words like "secure" or "verify" inserted into the domain. On a smartphone the address is often hidden: tap the sender's name to see it in full.
2. The links
Before clicking, hover over the link (on a phone, long-press it) and read the destination address. The button text may say "Sign in to your account" and lead somewhere else entirely. Read the domain from right to left up to the first single dot: in an address like bank.com.secure-login.net, the real domain is secure-login.net, not the bank.
3. The attachments
Compressed archives, Office documents asking you to "enable content", files with a double extension (for example invoice.pdf.exe) or disk images are classic vectors. An invoice you weren't expecting, from a supplier you don't know, shouldn't be opened: it should be verified.
4. The request
No bank and no serious service will ask you by email to send your password, your one-time code or your card PIN. If the message asks you to "confirm your details" through a link, that is already a strong clue.
5. The context
Ask yourself: was I expecting this email? Do I really have a parcel on its way? Do I actually use that service? Many scams are sent in bulk and hit people who, by chance, really do have a relationship with the imitated brand. A plausible context isn't enough to make a message genuine.
Spelling mistakes: a clue that is disappearing
For years people were told to look for grammar errors. Today many campaigns are written in correct language, helped by translation and automatic text generation tools. Mistakes are still a clue when they appear, but their absence proves nothing. It's better to rely on the sender, the links and the request.
A concrete example
Imagine receiving this: "Dear customer, we have detected unusual access to your account. To avoid it being blocked, verify your identity today by clicking here." The sender shows your bank's name, but the address ends with an unknown domain. The link points to a page that perfectly reproduces the bank's website. Three signs together: urgency, a request for credentials, an unofficial domain. The right move is to close the email, open the bank's app or type its address by hand, and check from there whether there really is an alert.
What to do if you're unsure
- Don't click and don't reply. Replying confirms that your address is active.
- Verify through an independent channel: the official app, the website typed by hand, the phone number on the back of your card or in your contract, never the one in the email.
- Report the message as phishing in your email client: it helps the filters recognise it for everyone.
- At work, tell whoever manages IT: if the message reached you, it has probably reached your colleagues too.
What if you've already clicked?
This isn't the moment to feel embarrassed, it's the moment to act quickly. If you entered a password, change it immediately from the official site, and change it anywhere else you had reused it. If you gave card details, call your bank and have the card blocked. If you opened an attachment, disconnect the device from the network and get technical help before you keep using it. Turn on two-factor authentication for the account involved if you hadn't already: it makes a stolen password much harder to exploit.
Habits that reduce the risk
- Use a password manager: it fills in credentials only on the correct domain, so on a fake site it suggests nothing. That's an excellent warning sign.
- Reach important services from your bookmarks or the app, never from links you receive.
- Keep spam filters on and don't automatically move messages flagged as suspicious back to your inbox.
- Take ten seconds before clicking whenever a message is rushing you.
In short
- Phishing exploits urgency, authority and curiosity: pressure is already a warning sign.
- Always check the sender's real address and where links actually lead.
- No serious service asks for passwords, one-time codes or PINs by email.
- Verify through an independent channel, never through the contacts in the message.
- If you've clicked, change your passwords at once and turn on two-step verification.