Most phishing emails give themselves away in the first ten seconds, long before you finish reading them. The trick is knowing which ten seconds. Instead of scanning for typos, check the parts a scammer has to fake and usually fakes badly: the real sender address, what the message wants you to do, and where the link actually points. Run those checks first, before the body of the email has a chance to persuade you, and most attacks fall apart on the spot.
Start With the Metadata, Not the Message
The subject line and the body are advertising. They exist to get you to click. The metadata — sender address, link destinations, reply-to address, attachment names — is much harder to fake and far more revealing. So work in this order: read the full sender address, check where the main link really goes, then ask what the email is pushing you to do. If those three things don't add up to the organisation that supposedly sent it, you're finished. Report, delete, move on.
Red Flag: The Display Name Doesn't Match the Address
Anyone can set the display name on an email to whatever they like. It takes seconds to make a message appear as "PayPal Service", "HR Department" or "Microsoft 365 Support" while the actual address behind it is something like service@paypa1-verify.ru.
Ignore the friendly name and read the domain — the part after the @ — ending at the first single slash. A message from paypal.com.account-check.net is not from PayPal; the real domain there is account-check.net. Watch for characters swapped to look similar: rn instead of m, a capital I for a lowercase l, digits standing in for letters. Extra hyphens, unusual country domains and words like "secure", "verify" or "billing" bolted onto a domain are all common.
On a phone
Mobile clients often hide the address behind the display name. Tap the sender name to expand it, then tap again to see the full address. Two taps settle most cases.
Red Flag: Manufactured Urgency
Phishing needs you emotional and quick, because a calm reader checks things. The usual pressure lines: your account will be suspended within 24 hours, an unauthorised login was detected, your payment failed, your parcel is about to be returned.
Urgency alone isn't proof of fraud — a bank can genuinely email you about a card issue. The tell is the combination: strong urgency, plus a link or attachment, plus a request to log in or pay. Organisations that truly need you to act fast give you a route you already trust, not a single button inside an email.
Red Flag: The Link Goes Somewhere Else
The words in a link and the destination of a link are two completely different things. Hover over a button on a desktop and the real address appears at the bottom of the window. On a phone, press and hold instead of tapping.
When you look at the address, check one thing first: the domain immediately before the first single slash. In https://login.yourbank.com.secure-auth.info/reset, the site you are actually visiting is secure-auth.info. Everything before it is decoration.
Quick ways to check a link without clicking:
- Hover on desktop or long-press on mobile to reveal the destination
- Read the domain just before the first single slash, and ignore everything after it
- Treat shortened links and buttons built into images as unreadable, because that is the point
- Be wary of QR codes in email, which hide the destination entirely
- If you want to check something, open your browser and type the organisation's usual address, or use its app
Red Flag: They Want Credentials, Codes or Money
No legitimate bank, employer, IT team or platform will email you asking for your password, a full card number, or the one-time code from your authenticator app. The code request is the dangerous one. If someone already has your password, a code typed into a fake page can complete the login while you are still reading the message.
Payment changes deserve their own rule. If an email asks you to update bank details for a payroll deposit, a supplier invoice or a transfer, do not confirm by replying. Call the person or company on a number you already have — not one from the email — and verify with a human.
Red Flag: Odd Attachments and Mismatched Context
Unexpected attachments are worth treating as hostile until proven otherwise, particularly .html, .htm, .zip, .iso files and documents that require macros to be enabled, such as .docm or .xlsm. A "secure message" that needs a login before you can read it is the same trick with an extra step.
Formatting helps too: a logo that looks slightly off, a generic "Dear Customer", a subject line that doesn't match the body. Just don't treat clean grammar as a green light. Plenty of phishing is well written and properly translated. Style is a hint; the sender address and the link destinations are evidence.
Three Examples That Should Fail in Ten Seconds
From: IT Helpdesk <it-support@company-helpdesk.net> — Subject: Your password expires today — "Your network password expires in 6 hours. Click here to keep your current password."
An external domain claiming to be internal IT, a link handling a password change, and a deadline measured in hours. No helpdesk needs your password, in any scenario.
From: Delivery Notification — Subject: Your parcel is on hold — "A small redelivery fee is required. Pay here."
You didn't order anything, or the order arrived already. The greeting is generic, the reference number means nothing to you, and the whole message exists to collect card details for a trivial amount people shrug off.
From: accounts@supplier-invoices.com, Reply-To: accounts@supplier-billing.co — Subject: Updated remittance details — "Please update our bank details and process today's payment."
The reply-to doesn't match the sender, the change concerns where money goes, and there is a deadline attached. Phone the supplier on a number from your own records before anything moves.
A Ten-Second Checklist
- Open the full sender address, not just the name
- Does that domain match the organisation it claims to be?
- Hover or long-press the main link — is the real destination expected?
- What does it want: a password, a code, a payment, an attachment?
- Is it using fear, urgency or a deadline to push you?
- Were you expecting this message at all?
If Something Still Feels Off
Trust the pause. If a message survives the checklist but still nags at you, don't act on it from your inbox. Open the app or website you normally use and check there, or call the organisation on a number from your own records.
Report it to your IT team or email provider, then delete it. If you did click, change that password immediately, turn on multi-factor authentication, and tell your IT team or bank. Speed matters more than embarrassment, and these messages are engineered to work on careful people. If money has already moved, ring your bank straight away — they have processes for exactly this, and the earlier they know, the more they can do. For anything involving large sums or a legal obligation, get proper professional advice rather than trusting an email thread.
Photo: cottonbro studio / Pexels
