Most phishing emails are not the clumsy, misspelled scams your spam filter used to catch. They arrive looking like a routine invoice, a password expiry notice, or a message from a colleague who needs one quick favour. What gives them away is rarely one dramatic detail. It is a small mismatch, repeated in a few places at once: a sender address that does not quite match the name, a link pointing somewhere unexpected, a deadline that exists only to stop you from thinking.

You do not need security training to spot these. You need about sixty seconds and a habit of checking three things before you click. Here are the seven red flags worth knowing.

1. The Display Name and the Address Disagree

Your inbox usually shows a display name, not the full address. "IT Support" or "Microsoft Account Team" can be typed by anyone. Tap or hover over the name to reveal the actual address behind it.

Look at the domain, the part after the @ symbol, and not just the words in it:

• Lookalike characters: paypa1.com, rnicrosoft.com, app1e.com
• Extra words: microsoft-support.com, apple-id-verify.net, dhl-parcel-tracking.info
• Wrong branch of the tree: real brand names appearing as a subdomain, like login.yourbank.com.account-check.xyz. The true domain is always the last part before the first single slash.
• Reply-to mismatch: the message comes from a company address but replies are directed to a free webmail account.

If your bank emails you from an address that is not the one printed on the back of your card or in your banking app, treat it as hostile until proven otherwise.

2. The Link Goes Somewhere Else

Link text is just decoration. The destination is what matters, and on a computer you can hover over the link to see it in the corner of the screen without clicking. On a phone, press and hold the link, then read the preview before you let go.

Two tricks are worth memorising. First, a long address can hide its real destination: https://yourbank.com.secure-login.example.org is not your bank, it is example.org. Second, anything before an @ sign in a web address is ignored by browsers, so yourbank.com@evil-host.net takes you to evil-host.net.

When a message pushes you to log in through a link, close the email and reach the site the way you normally would: typing the address, or using a bookmark or app you already trust.

3. Urgency, Threats, and Secrecy

Pressure is the engine of credential theft. Real organisations rarely threaten to close your account within two hours, and they do not need to. Ask yourself who benefits from you acting fast and reading nothing.

Your mailbox is full. Verify your account within 24 hours or incoming mail will be suspended.

Watch for the softer version too: an urgent favour from a colleague, a "quiet" request not to discuss a payment with anyone, or a demand that you keep a transaction confidential. Secrecy protects the attacker, not you.

4. Requests for Credentials, Codes, or a Password Reset

This is the line that matters most. No legitimate company or IT department will ask you to send your password by email, and no genuine support agent will ask you to read out a one-time code. Those codes exist precisely so that nobody can log in without your device.

Be equally suspicious of reverse requests: an email saying someone tried to log in and you must "confirm your identity" by entering your current password. Genuine security notices tell you what to do inside the app or website directly, not through a form in the message. If money is involved, confirm by phone using a number you already have, and check with a financial professional before sending anything.

5. Attachments and Generic Greetings

Unexpected files deserve a second look, especially HTML files, zipped documents, and invoices that need a login to open. These formats exist to smuggle a fake sign-in page past email filters.

Then read the greeting. If a company you have paid for years writes "Dear Customer" or "Dear Sir/Madam" instead of your name, that is a hint the sender is working from a database rather than your account. Add small quality signals: a logo that looks slightly stretched, a footer contact page that does not load, an email that arrives at 3 a.m. from a colleague who never writes at night.

6. A Sixty-Second Checklist Before You Click

1. Reveal the sender's full address. Does the domain match the company exactly?
2. Hover every link. Is the destination the official domain, spelled correctly?
3. Ask why this message arrived now. Is the urgency justified, or manufactured?
4. Check what is being requested. Password, code, payment, or gift cards mean stop.
5. Look for mismatches between the logo, the name, the address, and the greeting.
6. When in doubt, verify through a channel you chose yourself, not one the email gave you.

7. If You Already Clicked

Do not panic, and do not stay quiet. Act in order. If you typed a password, change it immediately on the real site, then change it anywhere you reused it, because credential stuffing is common. Sign out of active sessions if the service allows it. Turn on two-factor authentication, ideally with an authenticator app rather than text messages.

If you entered payment details, call your bank or card provider using the number on their website or your statement and explain what happened. If you opened an attachment, run a full malware scan and disconnect from the network if you notice unusual behaviour. Report the message to your IT team or email provider so it can be blocked for others, then delete it.

Finally, give yourself some credit for checking. The skill here is not memorising a list, it is slowing down for the sixty seconds when a message is pushing you to rush.

Photo: RDNE Stock project / Pexels