The "watch for spelling mistakes" advice has aged poorly. Well-run phishing campaigns now use correctly scraped brand assets, clean grammar, and sometimes AI-generated writing that reads naturally. The underlying mechanics of the attack haven't changed, though — and that's where the more reliable warning signs actually live.
What Every Phishing Attempt Is Trying to Do
Regardless of dressing, phishing has one of a few goals: get you to enter your password on a fake login page, open an attachment that installs malware, approve a fraudulent payment, or reply with sensitive information. Everything else in the message — urgency, authority, fear — exists to rush you past the point where you'd normally stop and verify.
Signs in the Sender
- Check the actual email address, not the display name. "Account Security Team" as a display name can be attached to literally any address.
- Look-alike domains. A close variant of a real domain — an extra word, a swapped letter, a different suffix — is a common tell. Legitimate companies send mail from their actual domain.
- Unexpected contact for the claimed relationship, such as a message from a bank you don't use or a service you've never signed up for.
Signs in the Message
- Artificial urgency — "your account will be suspended," "unusual sign-in detected," "payment failed." Legitimate issues rarely come with this much time pressure, and you can typically resolve them by logging in directly rather than through an embedded link.
- Requests for information a legitimate sender wouldn't need. Banks and most services never ask you to email or text your full password, PIN, or one-time verification code.
- Generic greetings on messages claiming urgent, personal relevance — though this sign alone isn't conclusive, since more sophisticated campaigns do personalize.
Checking Links Without Clicking
On desktop, hovering over a link (without clicking) shows a URL preview, usually in the corner of your browser or email client. On mobile, a long-press often shows the same preview. Compare the actual destination against what the message claims — a link labeled "Sign in to your account" that points somewhere unrelated is a clear warning sign.
A note on shortened links
URL shorteners hide the true destination and appear in both legitimate marketing and phishing. If one arrives in an unsolicited or urgent message, treat it cautiously — many shortening services offer a "preview" option to see the full destination before clicking.
Signs on a Fake Website
- Check the address bar carefully once you land on the page, not just the link you clicked — and remember that a padlock icon only confirms an encrypted connection, not that the site itself is legitimate.
- Login pages asking for unusual extra information beyond a normal username and password, such as a full Social Security number on what should be a simple sign-in screen.
- Broken internal links elsewhere on the site, common on quickly assembled fakes that only fully build the one page they need.
What to Do If You're Not Sure
Rather than clicking a link in a suspicious message, go to the company's site directly — type the address yourself or use a saved bookmark — and check your account status from there. A legitimate issue will still show up when you log in independently. For messages claiming to be from a specific person, verify through a separate channel, such as a phone call to a known number, not one provided in the message itself.
If You've Already Clicked or Entered Information
- Change the password for the affected account immediately, and for any other account where you reused it
- Enable multi-factor authentication if it isn't already active
- If financial information was entered, contact your bank or card issuer to flag the exposure
- Report the message to your email provider and to the company being impersonated
Act quickly rather than dwelling on it — phishing campaigns are specifically engineered to fool careful people, and prompt reporting meaningfully reduces the damage.
Frequently Asked Questions
Can a phishing email really look identical to a real one?
Yes — attackers can copy logos, formatting, and writing style directly. That's exactly why sender-address verification and link-destination checking matter more than visual polish when judging whether a message is legitimate.
Does HTTPS and a padlock icon mean a website is safe?
No. HTTPS only confirms an encrypted connection between your browser and the site, not that the site itself is trustworthy. Phishing sites frequently use valid HTTPS certificates.
Why do phishing messages create urgency?
Urgency is designed to short-circuit careful thinking. When you feel rushed, you're less likely to pause and verify a sender's address or a link's real destination — exactly the moment where most phishing attempts would otherwise fail.