The old advice was to look for spelling mistakes. That advice has aged badly. Modern phishing can be polished, personalized and well written, and writing tools have made fluent scam messages cheaper to produce. A better defense is not a checklist of typos but a habit: pause when a message pushes you to act, and verify through a channel you control.

What Phishing Is Trying to Do

Phishing is manipulation aimed at getting you to hand over something: a password, a payment, a code, access to your device, or personal details. The delivery varies. Email is the classic route, but the same tactics arrive by text message, phone call, social media direct message, messaging apps and even QR codes in public places.

The technical trick is secondary. The real lever is emotion. Messages are built to make you feel urgency, fear, curiosity, greed or the wish to be helpful.

Pressure Patterns Worth Recognizing

• Urgency with a deadline. “Your account will be closed in 24 hours.” Real organizations rarely demand instant action through a link.
• Authority. A message that appears to come from your boss, a bank, a delivery service or a government body.
• Fear. Suspicious activity, unpaid fees, a security alert.
• Reward. A refund you did not expect, a prize, a job offer that is surprisingly generous.
• Secrecy. “Do not tell anyone about this request.”
• A small, odd request. Gift cards, a changed bank account for an invoice, or “are you available?” from a supposed colleague, which is the opening move of a longer scam.

None of these proves a message is fraudulent, but any one of them is a reason to slow down.

Checks That Take Under a Minute

1. Look at the real sender address, not just the display name. Tap or hover to reveal it. Lookalike domains swap letters or add words.
2. Do not trust links as written. On a computer, hover to preview the destination; on a phone, press and hold. Better still, skip the link and open the service through your bookmark or the official app.
3. Treat attachments with caution, especially unexpected invoices, shipping documents or files that ask you to enable macros or editing.
4. Check the context. Were you expecting this? Does it use your name, or a vague greeting? Does it match how that organization normally contacts you?
5. Verify out of band. Call the organization using a number from its official site or the back of your card, or message your colleague through a different channel than the one the request arrived on.

Channel by Channel

Channel	Common bait	Safer response
Email	Account alerts, invoices, shared documents	Open the service directly, not via the email link
Text message	Delivery problems, bank fraud notices	Do not reply or tap; contact the company through its official app
Phone call	Caller claims to be your bank or tech support	Hang up and call back on a known number
Social media	Friend in need, investment tips, giveaways	Confirm with the person elsewhere; ignore too-good offers
QR code	Parking payment, menus, flyers	Check the destination address before entering any details
Workplace chat	Executive asking for urgent favors	Verify with a call or in person; follow company procedure

A Hypothetical Close Call

Imagine an office worker who gets an email, apparently from the finance director, asking her to update the bank details for a regular supplier before the end of the day. The tone is brief and familiar. The sender name is right, but the address, when she checks it, ends in a slightly different domain. She does not reply. She rings the finance director on the number from the internal directory and learns he sent nothing. She forwards the message to the security team using the reporting option, and the team warns others. Total time lost: five minutes. Possible loss avoided: a real payment to the wrong account.

If You Already Clicked

It happens to careful people. Act quickly and calmly:

• If you entered a password, change it immediately on the real site, and anywhere else you used the same one. Turn on two-factor authentication.
• If you opened an attachment or installed something, disconnect from the network if you can, run a scan with trusted security software and tell your IT contact.
• If you shared financial details, contact your bank or card issuer using official numbers; they can monitor or block transactions.
• If it involved a work account, report it right away. Early reports limit damage, and good organizations do not punish honest reporting.
• Keep the message as evidence, and report it through your email provider or local authorities where appropriate. Procedures differ by country, so look for official guidance in yours.

Habits That Make You Harder to Fool

Use a password manager. It will only autofill on the genuine address, which is a quiet but effective phishing alarm: if it does not offer your login, ask why. Keep software updated. Use two-factor authentication, ideally phishing-resistant methods on your most important accounts. And agree with family or colleagues on a verification routine for money requests, such as always confirming by phone.

Frequently Asked Questions

Can I get hacked just by opening a phishing email? Usually the risk comes from clicking links, opening attachments or replying with information. Opening alone is less risky, though keeping software updated reduces exposure to unusual cases.

Why do phishing messages sometimes know my name or employer? Information leaks from data breaches, public profiles and company websites. Personalization makes a message look credible but does not make it genuine.

Is a padlock icon in the browser proof that a site is safe? No. It indicates an encrypted connection, and fraudulent sites can have one too. Check the actual address and how you got there.

What should I do with a suspicious message? Do not click or reply. Use your email provider’s report-phishing option or your workplace’s reporting process, then delete it.

Do phishing tests at work help? Well-run exercises that teach rather than shame can build good habits. They work best alongside easy reporting and a no-blame culture.

Next Step

Find the report-phishing button in your email app today, and pick one person you would call to verify an unexpected payment request. Having both ready before you need them makes the right move automatic.