Phishing warning signs that still give attackers away

Phishing remains one of the most common ways attackers get a first foothold, because it targets people rather than software. The good news is that the warning signs are learnable, and a few habits stop most attempts.

The classic warning signs

Messages that create urgency or fear, such as an account about to be closed, are designed to stop you thinking. Check the sender address for lookalike domains, be cautious with unexpected attachments, and distrust any request to bypass normal approval steps or keep something secret.

Spelling is no longer a reliable clue

Attackers can now polish their writing with automated tools, so a well-written message is not proof of safety. Judge behavior instead of grammar: who is asking, why now, and does the request fit how this person normally works?

• Hover over links to see the real destination before clicking
• Open sites by typing the address or using your bookmark
• Confirm payment or password requests through a different channel
• Report suspicious messages instead of just deleting them

What to do if you clicked

Do not panic or hide it. Disconnect the device if you opened an attachment, change the affected password from a clean device, enable multi-factor authentication and tell your IT contact straight away. Early reports limit the damage.

Key takeaway: slow down, verify through another channel, and report anything suspicious.