Phishing works less because the messages are brilliant and more because they arrive while you are doing four other things. The useful defence is not paranoia — it is a short, repeatable check you can run in under a minute before clicking anything. Below are fifteen red flags, grouped by where they show up: the sender, the link, the wording, and the attachment. Any one of them can have an innocent explanation. Two or three together rarely do.
Sender and Address Red Flags
Display names are free text. Anyone can type "IT Helpdesk" or your finance director's name into that field, so open the full address before you trust the message.
- Display name and address disagree. A security alert from "Microsoft Account Team" arriving via a random Gmail address contradicts itself.
- Lookalike domains. The letters rn read as m, the number 1 reads as l, and hyphens or extra words such as yourcompany-hr.com cost almost nothing to register.
- Domain order tricks. In yourbank.com.secure-login.example, the real destination is example. Everything before it is decoration.
- A mismatched reply-to. If replies head somewhere the sender never mentioned, the scam depends on you not noticing.
- Cold first contact. A new supplier, auditor, or recruiter with an urgent request and no history with you.
Link Red Flags
Links are where phishing hides in plain sight. Before clicking, hover over the text — or long-press on a phone — and read the address that appears.
- The visible text says one thing and the real address says another.
- Shortened links hide the destination. Normal when a friend shares a news story, less so in an account or payment message.
- Long redirect strings with parameters like url= or redirect= pointing to an unrelated domain.
- A padlock is not a character reference. HTTPS means the connection is encrypted, not that the site is honest.
- The login page asks for more than the real one ever would — password, card number, and one-time code on a single screen.
If you cannot tell where a link leads, do not test it from the email. Open a new tab, type the address yourself, or use a bookmark you already have.
Language and Tone Red Flags
Urgency is the engine of most scams: deadlines measured in minutes, warnings that an account closes tonight, invoices "about to be escalated", a payroll change that must be confirmed before the next run. Real organisations do have deadlines. They rarely enforce them by email within ten minutes.
Pattern breaks matter more than tone. A colleague who suddenly asks for gift cards, a supplier who emails new bank details mid-project, a manager who needs your one-time code "because my phone died" — none of that fits how those people normally work. Treat any change to payment details as a phone call, not a reply.
Smaller tells still help: a greeting that avoids your name, a signature that does not match the sender, a subject line that ignores the thread it claims to answer, sentences that read as translated or stiffly formal. Well-written phishing exists, so clean grammar proves nothing. But sloppy or oddly punctuated messages deserve a second look.
Attachment Red Flags
Anything you did not ask for deserves suspicion, especially when it arrives with pressure to open it now.
- HTML files — an "invoice" that is really a web page opening a fake login form in your browser.
- Documents that ask you to enable macros or content before you can read them.
- Archives protected with a password sent in the same email, a trick for slipping past scanners.
- Double extensions such as invoice.pdf.exe, and unusual formats like .iso, .img, .js, .scr, or .lnk.
- File names that do not match the message: a "shipping confirmation" carrying a spreadsheet.
The Checks People Skip
Were you expecting it? An invoice from a supplier you use is routine. The same invoice marked "second reminder", when you never received a first one, is not.
Does the timing make sense? Phishing often lands at the end of the day or the end of a quarter, or while the person being impersonated is travelling and hard to reach.
Is the thread real? Attackers who compromise a mailbox reply inside genuine conversations, keeping the subject line and history intact. A familiar thread is not proof of a familiar sender.
Can you verify out of band? Call the person on a number you already have — not the one in the email — or walk over and ask. That short call is cheaper than untangling a fraudulent payment for a week.
A Sixty-Second Routine Before You Click
- Pause. Nothing legitimate collapses if you take a minute.
- Read the full sender address, not just the display name.
- Hover every link and compare the destination with the sender's domain.
- Ask whether you expected this message, from this person, today.
- Leave unrequested attachments closed.
- Verify anything involving money, credentials, or personal data by phone or in person.
- Report the message to your IT or security team instead of quietly deleting it.
If You Already Clicked
Skip the embarrassment and act quickly. Change the password for the affected account from a different device, turn on multi-factor authentication if it is not already enabled, and tell your IT or security team what you clicked and when. If you entered card details, contact your bank through the number on your card. If a document asked you to enable content and you did, disconnect the machine from the network and report it rather than trying to clean it up alone. Expect follow-up attempts: once an address is known to be live, more messages usually arrive.
For anything with financial or legal consequences, speak to your bank or a qualified professional before making decisions. And remember that the checklist is not about distrusting everyone — it is about slowing down just enough that the clicks you make are the ones you chose.
Photo: Torsten Dettlaff / Pexels
