Recognizing Common Signs of a Phishing Message

A locked door and a convincing fake key look nothing alike up close, but from a distance, both can seem like legitimate ways into a house. Phishing messages work the same way — they’re designed to look close enough to the real thing at a glance that most people don’t look closely enough to notice the difference before clicking.

Check the Sender’s Actual Address, Not Just the Name

A message might display a trusted-looking name, but the actual email address or number behind it often reveals mismatched domains, extra characters, or unfamiliar formatting. Taking a moment to view the full sender details, rather than trusting the display name alone, catches a large share of phishing attempts before anything else needs to happen.

Watch for Urgency and Pressure Tactics

• Threats of an account being suspended within hours
• Claims that immediate action is required to avoid a penalty
• Pressure to act before verifying through another channel

Legitimate organizations rarely demand instant action through a single message with no other way to confirm the request. Manufactured urgency is one of the most reliable warning signs, specifically because it’s designed to stop you from pausing to think it through.

Hover Before You Click

On a computer, hovering over a link without clicking usually reveals the actual destination address in a small preview. A mismatch between the text of the link and where it actually leads is a strong indicator that something isn’t right, even if the surrounding message looks otherwise polished and convincing.

Be Skeptical of Unexpected Attachments

An attachment you weren’t expecting, especially one framed as an invoice, a shipping notice, or a document requiring urgent review, deserves extra caution before opening. When in doubt, contacting the supposed sender directly through a separate, known channel is far safer than opening the file to check for yourself.

Verify Independently Rather Than Through the Message Itself

If a message claims to be from your bank, workplace, or a service you use, the safest response is to contact that organization directly through a number or website you already know, rather than any contact information provided within the suspicious message. This single habit closes off nearly every path a phishing attempt relies on to succeed.

Slow Down Before Reacting Emotionally

Messages designed around fear, excitement, or curiosity tend to short-circuit careful thinking, which is exactly the reaction phishing attempts are built to provoke. Taking even a short pause before clicking, replying, or downloading anything gives the more careful, rational part of your thinking a chance to catch what the initial emotional reaction missed.

Report Suspicious Messages Rather Than Just Deleting Them

Most email providers and workplaces offer a simple way to report a suspected phishing message, which helps flag the sender for others and sometimes improves automatic filtering going forward. Taking the extra few seconds to report rather than only deleting turns an individual close call into a small protective measure for other people too.