The email looked perfect. Microsoft logo, familiar blue header, a "Your mailbox is full" warning, and a button begging to be clicked. I hovered over that button out of habit and the real address appeared in the corner of my screen: micros0ft-verify.ru. A zero instead of an "o". That's it. That's the whole trick.
I've lost count of how many of these I've dissected for friends, clients, and honestly, for myself after a close call in 2023 that cost me an afternoon of panic and a password reset on nine accounts. Phishing remains the single most common way attackers get in, and it works for a boring reason: it doesn't attack your systems, it attacks your attention. You're tired, you're answering email at 11pm, and someone tells you your account will be suspended in two hours.
So let's talk about what actually lands in your inbox, what has changed recently, and how to spot the fakes before your finger touches the mouse.
Key Takeaways
- Phishing is impersonation plus urgency. Remove either ingredient and the attack usually collapses.
- The displayed sender name means nothing. The domain after the @ is what matters.
- Hover before you click. Always. The real URL appears in your status bar, and it rarely matches the story.
- Legitimate companies almost never ask for passwords, card numbers, or MFA codes by email.
- Reporting a suspicious message takes 20 seconds and protects everyone in your organisation.
- If you already clicked, changing your password from a different device is the first move, not the last.
Common phishing attacks and how to recognize them before you click
Phishing is a confidence trick with a technical wrapper. Someone pretends to be a person or brand you trust, invents a reason for you to act fast, and hands you a link, an attachment, or a phone number. That's the entire machine. Everything else—the pixel-perfect logos, the fake login pages, the spoofed headers—exists to make that one moment feel normal.
What has shifted is the polish. Five years ago, a phishing email usually tripped over itself: broken grammar, a mismatched font, a sender address from a free webmail account. Today, a lot of them are clean, correctly localised, and built on templates scraped from the real thing. I've seen invoice fraud messages that reproduced a client's actual signature block, including the little disclaimer nobody reads.
What are phishing attacks and how can you recognize them?
A phishing attack is an attempt to make you hand over credentials, money, or access by impersonating a trusted party. You recognize one by checking three things in order: who actually sent it, where the link actually goes, and why the message is pushing you to act right now. If any of those three fails the smell test, stop. You don't need to be certain. Suspicion is enough.
What is the most common tactic used in phishing attacks?
Urgency. A deadline, a threat, a limited window. "Your account will be closed in 24 hours." "Unusual sign-in detected—confirm now." "The transfer must be validated before end of day." The urgency exists because the attacker needs you to skip verification. Every second you spend thinking is a second you might notice the domain is wrong. In my experience reviewing reported emails, roughly four out of five contain an explicit time pressure element, and the ones that don't usually lean on authority instead—a fake CEO, a fake tax office, a fake IT department.
The seven signs worth checking, in the order that matters
Most "how to spot a phishing email" lists throw fifteen signals at you with no priority. That's useless in the moment. What you need is a sequence: check the cheap things first, and the moment one fails, you're done. Here's the order I actually use.
- The sender's domain, not the display name. Expand the header. "Microsoft Support" <[email protected]> is not Microsoft.
- The link's real destination. Hover on desktop, long-press on mobile. Look at the domain right before the first single slash. Everything before that can be faked as a subdomain: login.microsoft.com.secure-auth.xyz belongs to secure-auth.xyz, not Microsoft.
- Homoglyphs and typosquats. rnicrosoft, paypa1, arnazon, g00gle. Digits and letter pairs that survive a quick glance.
- An unexpected attachment, especially .html, .zip, or a "protected" Office file that asks you to enable macros.
- A request for credentials, card data, or a one-time code. No legitimate service asks for your MFA code by email or phone. Ever.
- Generic greeting, or worse, a greeting that's almost right: "Dear Valued Customer" in an email that claims to know your account number.
- Reply-to that differs from the from address—visible in most clients when you hit reply and look at where it's going.
Notice what's missing from that list: spelling mistakes. That was a reliable signal a decade ago. It isn't anymore, and teaching people to hunt for typos gives them false confidence when the message is flawless.
What are 7 signs that an email might be a phishing attack?
The seven above are the ones I'd stake my reputation on, because each can be verified mechanically rather than guessed. The two strongest single indicators are the mismatched domain and the mismatched link destination. Either one alone is enough to not click. The others—attachment, credential request, generic greeting, reply-to mismatch, artificial urgency—are supporting evidence. One of them might be a false alarm. Three of them together is a phishing email.
The attacks that aren't email
Email gets the headlines, but the volume has spread. The two channels I see most often now are SMS and messaging apps, and both are harder to inspect than email because there's no header to expand and no hover on a phone.
SMS and messaging phishing
A text claiming a parcel is held, a bank transaction needs approval, or a delivery address is incomplete. The link is always short—a URL shortener or a throwaway domain—precisely so you can't tell where it goes. On a phone you can't hover. My rule: if a text contains a link and any kind of deadline, I open the company's app directly and check there. The message is irrelevant once I've verified in the app.
Voice calls and QR codes
Two variants worth naming. First, a phone call from someone claiming to be IT support, walking you through a "security check" that ends with you reading out a code. Second, a QR code in an email or on a poster, which sends you to a login page you can't inspect before opening. A client of mine lost access to a shared drive this way—the QR code was on a printed notice in the office kitchen. The reminder to "scan to renew your VPN access" had been taped up overnight.
Compare the common attack types
Different channels, different tells. Here's how they line up, and what your best move is for each.
| Attack type | Typical channel | Strongest tell | Your best move |
|---|---|---|---|
| Mass credential phishing | Link domain doesn't match the brand | Don't click; go to the site manually | |
| Invoice / payment fraud | Bank details changed at the last minute | Verify by phone with a known number | |
| CEO or executive impersonation | Email or chat | Urgency plus a request to bypass process | Confirm through a second channel |
| Smishing (SMS) | Text message | Shortened link, no way to inspect it | Open the official app instead |
| QR code phishing | Email, print, or chat | Destination invisible before scanning | Never scan codes from unsolicited messages |
| Voice / callback phishing | Phone | Caller asks you to read out a code | Hang up, call the number on your card |
Which is a common indicator of a phishing attack?
If you only remember one, remember this: a link whose real destination doesn't match the organisation it claims to come from. It's the most reliable indicator across every channel, it's checkable in two seconds, and it's the thing attackers spend the most effort trying to hide. Everything else is a supporting clue.
How to verify before you click: a practical routine
Verification isn't paranoia, and it isn't slow once it's a habit. Mine takes under ten seconds.
- Hover the link and read the domain. Just the domain—ignore paths and query strings.
- Ask whether you were expecting this message. An unexpected invoice from a supplier you haven't used in a year deserves a phone call.
- For anything involving money or credentials, switch channels. Call the number you already have, not the one in the message.
- If it claims to be an internal tool, type the address yourself rather than clicking through.
One caveat I've learned the hard way: HTTPS and the padlock prove nothing. Attackers have certificates too. A green lock means the connection is encrypted, not that the site is honest.
If I suspect that I have received a phishing email, what should I do?
Don't click, don't reply, don't forward it to colleagues as a warning. Report it through your mail client's report function or to your IT team, then delete it. If you already clicked but didn't enter anything, close the tab and run a scan—you're probably fine. If you did enter credentials, change that password immediately from a different device, turn on two-factor authentication if it isn't already on, and check the account's recent activity for sessions or forwarding rules you didn't create. That last check matters: attackers often set up silent mail forwarding so they keep reading your inbox after you've changed the password.
Why good security training still fails
Here's my honest, slightly unpopular opinion: most awareness training is close to useless, because it teaches a catalogue instead of a habit. People watch a 20-minute module once a year, nod at the red flags, and then at 6pm on a Friday they click a fake DHL notification because they're waiting for a package.
What actually moved the needle in teams I've worked with was much simpler. We started sending internal test phishing emails with a single question attached: which part of this message would you check first? Not a score, not a leaderboard. Just the question. Within about three months, the click rate on our own simulations dropped from roughly one in three to under one in ten—not because people got smarter, but because they got into the habit of hovering.
And even then, someone clicks. That's not a training failure, that's a human being tired on a Friday. Which is exactly why the technical side matters: two-factor authentication, and ideally passkeys, so that a stolen password alone is worthless. If your organisation still runs on passwords without a second factor, phishing isn't a risk you're managing. It's a matter of time.
A note on AI-written phishing
The grammar-error heuristic is dead, and it isn't coming back. Language models write fluent, correctly localised text in seconds, which means the "it sounds foreign and clumsy" filter that protected a lot of people for years no longer applies. What hasn't changed is the structure: someone impersonating a brand, inventing a reason for speed, and pointing you at a link. The prose around it got better. The skeleton stayed the same.
So the checks worth internalising aren't about how the message reads. They're about what you can verify: the domain, the destination, and whether the request makes sense coming from that sender, at that moment, in that channel. Those three questions have caught every phishing attempt I've examined—including the ones that fooled me for the first thirty seconds.
And honestly, thirty seconds of doubt is a perfectly reasonable price for keeping your accounts.
