Attackers are getting better. But the tell-tale signs are still there if you know where to look.
The 8-Point Phishing Inspection
1. SENDER
Hover or tap the From address. Is it the real domain? support@amaz0n.com is fake. Look for character substitution (0 for o, rn for m).
2. SUBJECT & TONE
Urgency, threats ("account will be closed"), prizes, or "your package" you didn't order are massive red flags.
3. GREETING
"Dear Customer", "Valued User", or misspelled name. Real companies usually know your name or use the email you registered with.
4. LINKS & BUTTONS
Hover every link (don't click!). Does the URL match the claimed company? Shorteners, IP addresses, or extra subdomains are suspicious.
5. ATTACHMENTS
Unexpected .zip, .iso, .js, .exe, .docm, or .html attachments. Even PDFs can be weaponized. Verify first.
6. GRAMMAR & DESIGN
Typos, odd spacing, low-res logos, or generic stock photos. Professional organizations rarely have these.
7. REQUEST
Asks for passwords, 2FA codes, bank details, or for you to "confirm" by clicking. Legit companies already have this data or use secure portals.
8. CONTEXT
Did you recently order something? Are you expecting a password reset? If not — treat it as suspicious.
Real Examples (Learn by Seeing)
Head to the Interactive Tools page for a hands-on simulator with 4 live examples you can dissect.
Pro move: Use "Report as phishing" in your email client
Most corporate and good personal email services (Gmail, Outlook, Apple Mail) have a Report Phishing button. This helps train filters for everyone. Do it even if you're not 100% sure — better safe.
What if you already clicked?
Disconnect from the internet or put the device in airplane mode if you think malware may have downloaded.
Change passwords from a different clean device (starting with your email).
Scan with reputable antivirus / use your OS built-in scanner.
Enable 2FA on everything if not already.
Monitor accounts and report to your bank/IT if anything looks off.