Phishing has stopped looking like phishing. The misspelled Nigerian prince has been replaced by a pixel-perfect copy of a real notification from a service you genuinely use, arriving at a moment when it is entirely plausible.
Spotting them is less about noticing bad English and more about a handful of structural tells that are difficult to fake.
Read the domain, not the display name
The sender name in your inbox is free text. Anyone can put “PayPal Security” there. What matters is the part after the @ symbol, and specifically the last two segments before the first slash.
Attackers exploit the fact that people read left to right and stop early:
paypal.com.security-alert.netis security-alert.net, not PayPalsecure-paypal.comis a different company entirelypaypa1.comuses a digit one in place of the letter l
The real domain is always the bit immediately before the first single slash. Train yourself to look there and most attempts collapse instantly.
Hover before you click
Link text is also free text. A link reading https://yourbank.com can point anywhere at all.
On a computer, hover the pointer over the link and read the real destination in the status bar. On a phone, press and hold and the address appears in a preview without opening it.
If the visible text and the actual destination disagree, that is not a formatting quirk. It is the entire attack.
Urgency is the tell
Nearly every phishing message engineers time pressure, because thinking is what defeats it.
Account suspended within 24 hours. Unusual login detected. Payment failed, service ending today. Package undeliverable, confirm now.
Genuine organisations rarely give you hours to act, and never make the only route a link in an email. When something feels urgent, that feeling is the product being sold to you.
The rule that makes all of this unnecessary
Never act through a link in an email about an account.
If your bank appears to have emailed about a problem, close the email. Open your browser, type the address you always use or open the app, and look for the same notice there.
If the message is real, it will be waiting in your account. If it is not there, you have your answer and you never had to evaluate anything.
This single habit defeats essentially every phishing attempt, including the ones sophisticated enough to fool you on inspection. It costs about fifteen seconds.
Attachments
Be sceptical of unexpected attachments even from people you know, because a compromised account sends genuine-looking mail from a genuine address.
Treat anything ending in .exe, .scr, .iso or .zip as hostile unless you were expecting it. Office documents that open with a prompt to “enable content” or “enable macros” are a classic delivery route; that prompt is asking permission to run a program.
If a colleague sends something unexpected, message them separately to ask. Not by replying to the email.
The details attackers cannot fake
- They do not know what you own. A notice about a subscription you do not have, or a delivery you did not order, is answered by that fact alone.
- They usually do not know your name. “Dear Customer” from a company that has always used your first name is a signal.
- They cannot show real account details. Genuine messages often cite the last four digits of a card or a real order number.
- They cannot survive a phone call to the number printed on your actual card, rather than the number in the email.
The protection that works even if you fall for one
Two-factor authentication means a stolen password alone is not enough. It is the single most effective thing you can enable, and it turns a catastrophe into an inconvenience.
Prefer an authenticator app over text messages where the choice exists, since text codes can be intercepted by attacks against your phone number. Hardware keys are stronger still.
And if you have already entered a password somewhere you should not have: change it immediately, change it anywhere else you reused it, and check the account for forwarding rules or new devices. Attackers commonly add a quiet mail forwarding rule so they keep reading after you have reset the password.
Phishing is often paired with software flaws nobody has patched yet. Here is what a zero-day vulnerability is.
Join the discussion