Cybercriminals do not always need to break through sophisticated technical security controls. Sometimes it is easier to persuade a person to provide a password, open an attachment or approve a fraudulent request.
This type of manipulation is commonly associated with social engineering. Phishing is one of the most familiar examples.
Treat unexpected requests as unverified until you have confirmed them through a trusted channel. A professional-looking email is not proof that the sender is legitimate.
Warning Sign 01
Check the Sender Address Carefully
A phishing email may display the name of a legitimate organisation while actually being sent from an unrelated or misleading address.
Attackers may use addresses that look similar to genuine domains by adding letters, changing spelling or using unusual domain endings.
Things worth checking
- Does the sender address match the organisation it claims to represent?
- Is the spelling of the domain correct?
- Is the message coming from an unusual personal email address?
- Is the display name hiding a different underlying address?
Warning Sign 02
Be Suspicious of Extreme Urgency
Phishing messages often try to create pressure. The goal is to encourage you to act quickly before you inspect the message carefully.
Examples may include claims that an account will be suspended immediately, a payment must be made within minutes, or a security problem requires urgent verification.
Common pressure tactics
- "Your account will be closed today."
- "Payment failed — update now."
- "Immediate action required."
- "Your mailbox is over quota."
- "Confirm your identity immediately."
Urgency alone does not prove that an email is malicious, but it should make you slow down and verify the request.
Warning Sign 03
Inspect Links Before You Use Them
A link can display one address while sending you somewhere completely different.
On a desktop computer, you can often hover over a link without clicking it to inspect the destination shown by the browser or email client.
On mobile devices, use extra caution because full addresses may be harder to inspect.
Safer approach
If an email claims to come from your bank, Microsoft, a delivery provider or another known organisation, consider opening the organisation's trusted website or application yourself instead of following the message link.
Warning Sign 04
Watch for Fake Login Pages
One common phishing technique is to copy the appearance of a real Microsoft, banking, social media or business login page.
The page may look convincing while the website address belongs to the attacker.
Before entering credentials, check that you are on the expected website and that the domain is correct.
A padlock icon or HTTPS connection does not automatically mean a website is trustworthy. Attackers can also obtain encrypted connections for malicious websites.
Warning Sign 05
Treat Unexpected Attachments Carefully
Attachments can be used to deliver malicious software or convince users to enable unsafe content.
Be particularly cautious when an attachment is unexpected, comes from an unfamiliar sender or does not match the normal context of the conversation.
Ask yourself
- Was I expecting this file?
- Do I know the sender?
- Does the attachment make sense in context?
- Is the sender asking me to enable unusual settings?
- Can I confirm the file through another trusted channel?
Warning Sign 06
Be Careful With Payment and Invoice Requests
Financial requests deserve additional verification. Attackers may impersonate suppliers, managers or business contacts and ask for payments to be redirected to a new bank account.
They may also send fake invoices or pretend an urgent transfer is required.
Businesses should have a trusted process for validating changes to payment details.
Verify unusual financial instructions through a trusted contact method already known to you rather than using contact details supplied in the suspicious email.
Warning Sign 07
Watch for Impersonation
A phishing message may pretend to come from a manager, colleague, supplier, government agency or well-known company.
The message may contain enough familiar information to appear believable.
Do not rely solely on names, signatures, logos or profile pictures. These can often be copied.
Be especially cautious when the request
- Is unusual for the person.
- Requests secrecy.
- Requests gift cards or money.
- Changes normal payment procedures.
- Requests passwords or authentication codes.
- Pressures you to act without checking.
Warning Sign 08
Never Share MFA Codes or Approve Unknown Requests
Multi-factor authentication provides an important extra security layer, but an attacker may still try to trick you into helping them complete a sign-in.
Never provide an authentication code to someone who contacts you unexpectedly.
If your authenticator application asks you to approve a login you did not initiate, deny the request.
Warning Sign 09
Poor Grammar Is Not the Only Warning Sign
Older phishing messages were sometimes easy to identify because of obvious spelling mistakes or poor formatting.
Modern phishing emails can be polished, correctly written and professionally formatted.
This means users should not assume a message is legitimate simply because it looks professional.
Look at the complete context: sender, domain, request, links, attachments and expected behaviour.
Warning Sign 10
When in Doubt, Verify Independently
You do not need to make an immediate decision simply because an email asks you to.
If something feels unusual, stop and verify.
Contact the person or organisation through a trusted method you already know.
In a workplace, suspicious messages can also be reported to the appropriate IT or security contact.
Quick Phishing Checklist
If You Already Clicked
What Should You Do If You Think You Fell for Phishing?
Acting quickly can help reduce the impact of a suspected phishing incident.
The correct response depends on what happened. Clicking a link is different from entering a password, approving an MFA request, opening an attachment or transferring money.
General first steps may include
- Stop interacting with the suspicious page or message.
- Change exposed passwords from a trusted device if credentials were entered.
- Review the affected account for suspicious activity.
- Inform your IT or security contact if the incident involves a work account.
- Contact the relevant financial institution quickly if money or banking details may be involved.
- Seek professional assistance when the scope of the incident is unclear.
Reporting a suspicious message quickly is better than hiding a mistake. In business environments, early reporting can give IT or security teams more time to investigate and limit possible impact.
Final Thoughts
Phishing works because attackers try to create trust, fear, urgency or curiosity.
The strongest habit is simple: slow down before clicking, entering credentials, opening files or approving unexpected requests.
Security awareness works best alongside technical controls such as MFA, endpoint protection, email filtering, secure account configuration and good access management.