How to spot a phishing email before it costs you
6 min read
Phishing emails have gotten more convincing over the years, generic advice like 'watch for bad spelling' is far less reliable than it used to be, since well-crafted phishing attempts often look polished, sometimes indistinguishable at a glance from a genuine email.
Signs that actually matter now
Urgency pushing you to act immediately without time to think, a request to click a link and enter login details or payment information, and a sender address that looks almost right but isn't quite (a extra letter, wrong domain) are the most reliable signs, far more than spelling or design quality, since design quality tells you nothing about legitimacy anymore.
Why urgency is the single most reliable red flag
Legitimate organizations rarely demand immediate action with no room to verify independently, phishing relies on creating panic that short-circuits normal caution. If an email is pushing you to act right now or face some consequence, that pressure itself is worth treating as a warning sign, regardless of how official the email otherwise looks.
The safest habit to build
Rather than clicking a link in an email claiming to be your bank, delivery company, or a service you use, go directly to the official app or website yourself and check from there. This alone defeats the vast majority of phishing attempts regardless of how convincing the email looks, since it removes the fraudulent link from the equation entirely.
What to do if you've already clicked something suspicious
If you've clicked a link and entered credentials, change that password immediately (and anywhere else you reused it, a real reason to avoid password reuse in the first place), and enable two-factor authentication on the account if it isn't already active. Acting quickly meaningfully limits the actual damage, even after a mistake.
What we set up to help
Where relevant, we help configure spam filtering and two-factor authentication on key accounts, which meaningfully reduces both how many phishing attempts reach you and the damage if you do click something you shouldn't.