Phishing does not work through technical sophistication. It works through routine. The message looks like something you were expecting anyway and pushes you towards a quick action. Once you know the recurring patterns, you can spot almost all of it in seconds.
1. Time pressure
"Your account will be suspended within 24 hours." "Your domain is expiring." "Final notice." No serious provider announces a consequential suspension by email with a one-day deadline. Time pressure exists to prevent exactly one thing: that you stop and think.
2. The sender is almost right
Fraudsters register domains that resemble the original: an extra hyphen, a swapped letter, a different ending. On a phone you often only see the display name, not the address behind it — tap it to reveal.
3. The link goes somewhere else
Visible link text is arbitrary and has nothing to do with the destination. Hover over it without clicking; the browser shows the real target at the bottom left. On a phone: tap and hold.
Look at the part immediately before the first single slash — that is the actual domain. In https://bank.com.security-update.example/login it is security-update.example, not bank.com.
4. Impersonal, or oddly personal
"Dear customer" from a provider that knows your name stands out. But the reverse proves nothing: a message containing your name means little. Names sit in the same data leaks as addresses.
5. An action that has no business being in email
Entering credentials, confirming payment details, changing a bank transfer, passing on a code. No bank, payment service or public authority asks for any of that by email.
6. Attachments that would not be needed
An invoice as an attachment although you have an account with the provider. A delivery note for an order you never placed. Particularly risky: Office files with macros, and archives hiding an executable.
7. Language and design are slightly off
Crude errors have become rarer since texts are machine translated. The small things remain: an outdated logo, the wrong form of address, a mix of formal and casual tone, a legal notice that does not fit.
8. The header contradicts the content
This is the only sign you can verify rather than merely judge. The message header records which server submitted it and whether the sender domain's checks passed. If it says spf=fail or dmarc=fail while the sender claims to be a major brand, the case is settled. How to read the header is covered in a separate post.
A pattern we saw ourselves
In one afternoon our mailboxes received 180 identical messages: same subject, same sender domain, exactly one per address. The content claimed a domain was expiring and had to be renewed immediately. Three markers at once — time pressure, an invented administrative process, and a bulk send working through a list. We wrote up the analysis in a separate post.
What to do if you clicked
- Entered nothing? Then usually nothing happened. Close the page.
- Entered credentials? Change the password immediately — for that service and anywhere you used the same one. Then turn on two-factor authentication.
- Entered payment details? Call your bank or card issuer and block the card. Not by email — by phone, using the number on the card.
- Opened an attachment? Disconnect the device from the network and have it checked.
And in every case: no need for embarrassment. These messages are designed to work in an inattentive moment. That is exactly why they are sent by the million.