Most phishing messages do not announce themselves. They arrive on a Tuesday, wedged between a meeting invitation and an invoice approval, wearing the face of a colleague, a bank, a courier or your own help desk. The ask is almost always small: confirm one detail, open one PDF, re-enter one password. The damage can be a mailbox, a payroll run or a client's records.
What follows is a checklist you can run in under a minute, before your curiosity does the clicking for you.
The sixty-second gut check
Start with a single question: does this message want me to do something that a normal day does not require? Phishing needs your hands on a keyboard. If nothing in the message is asking you to click, download, approve, pay or reply with information, it is not urgent.
Then look at three things, in order: who really sent it, what they want, and whether that request makes sense given your role and the relationship you actually have with that person or company. Discomfort is data. If something feels slightly off, slow down instead of explaining the oddity away.
Check who actually sent it
Display names are free
Anyone can label a message "Microsoft 365 Support" or "Anna Kowalska, CEO". That label is decoration. Expand the sender field or hover over the name to see the real address. On a phone, tap the sender to reveal the full address instead of the nickname saved in your contacts.
Lookalike domains depend on speed
Attackers count on you reading the first few characters and moving on. Watch for a lowercase l where a capital I belongs, an rn pretending to be an m, a hyphen in the wrong place, or a familiar brand on an unfamiliar ending. A message from your bank at yourbank-secure.net is not from your bank, no matter how official the logo looks. If you open full headers, check the reply-to as well, because replies often route somewhere unrelated to the visible sender.
Read the ask, not just the wording
Polished spelling proves nothing; plenty of phishing today is clean, well-designed and grammatically boring. The reliable signals live in the request itself:
- Urgency with a deadline. "Your account closes in two hours." Real institutions rarely create panic, and never through a link.
- Authority. A message that appears to come from an executive, a regulator or a senior colleague you have never exchanged mail with.
- Secrecy. "Keep this between us for now" or "I'm in meetings, just handle it" removes your ability to sanity-check with anyone.
- A channel switch. Email to WhatsApp, LinkedIn to text, a "wrong number" that turns into a friendly conversation and then a request.
- Credential requests. Any prompt for a password, a one-time code or a security-question answer. No legitimate service asks for your MFA code.
- Payment and banking changes. New account details for a supplier, an updated payroll form, a refund that needs your card number.
Read the request out loud if you can. "The CFO wants gift cards within the hour" sounds absurd spoken aloud and perfectly reasonable when you are scrolling during a call.
Verify links and attachments without clicking
Hover the link on a desktop or long-press it on a phone to see the destination. Read the address from right to left: the domain immediately before the first single slash is the one that matters. A link that starts with a legitimate-looking name and ends with an unrelated domain is bait, and a shortened link hides its destination entirely.
Attachments deserve the same suspicion. Unexpected invoices, shipping notices, scanned contracts, HTML files and password-protected archives are common delivery vehicles. If you were not expecting the file, confirm with the sender through a channel you already trust, or open it in a preview tool rather than on your work machine. When in doubt, go to the service directly by typing the address into your browser instead of using the link.
Texts, DMs and QR codes follow the same rules
SMS and chat apps strip away most of the context you rely on: no signature block, no domain, no help desk banner. A short message claiming a parcel is stuck, a toll is unpaid or a colleague needs a quick favour is enough. Treat any unexpected link from an unknown number as hostile until proven otherwise, and be sceptical of friendly openers like "Hi, is this Maria?" from a number you do not recognise.
QR codes are simply links you cannot read before scanning. Check the preview URL your camera shows, and never scan a code from an email or poster that also pressures you to log in or pay. If a QR code is stuck over a legitimate one in a public place, assume tampering.
When the request looks legitimate
The hardest cases involve things you genuinely expect: an invoice from a real supplier, a document from a real client, a password reset you did request. Verify out of band. Call the person on the number you already have, not the one in the message. For payments or bank detail changes, confirm by voice with a known contact, and treat any pressure to skip that call as a red flag in itself.
If you clicked or replied, act in this order
- Disconnect and stop. Do not keep clicking or fill in a second screen. Leave the message in place rather than deleting it.
- Change the password from a different, trusted device, starting with the account involved and then any account that shares the same password.
- Report it internally the same hour. Speed matters far more than dignity, and your report protects colleagues who receive the same message.
- Check for follow-up. Attackers often return as "IT" offering to help with the problem they caused, this time asking for a code.
If money has already moved, contact your bank immediately, since recovery options shrink quickly, and take advice on the specifics from the bank or a qualified professional rather than from anyone who contacted you first.
None of this requires technical skill. It requires a habit: pause at the request, confirm the sender, verify anything involving credentials or money through a channel you chose yourself. The people who spot phishing fastest are not the most suspicious by nature. They are simply the ones who have decided in advance what they will not do on autopilot.
Photo: Tumisu / Pixabay
