Most phishing emails no longer arrive with broken grammar and a suspicious attachment. They look like a password reset from your payroll system, a delivery notice from a courier you actually use, or a two-line note from your manager asking for a quick favour. That is the point: they are built to blend into a busy inbox.
You do not need to memorise a catalogue of scams. You need a small set of checks you can run in under a minute, every time an email asks you to log in, pay, download, or keep quiet. Here are ten red flags worth treating as a stop sign.
1. Lookalike Domains and Sender Details
The display name is decoration. Anyone can set it to "Microsoft 365 Support" or your bank's name. The real information sits after the @ symbol, so read the address from right to left.
Red flag 1: The domain is almost right. Look for swapped characters (rn instead of m, a zero for the letter O, a lowercase L for a capital I), extra words like -secure, -billing or -support, and the wrong ending — .co where you expect .com, or an unfamiliar country code. Attackers also register domains that read sensibly at a glance, such as a supplier's name with "portal" or "invoices" bolted on.
Red flag 2: The reply path does not match. A message that appears to come from a colleague but has a reply-to address at a free mail provider is a classic sign. Watch for mid-thread switches too: "I'm travelling, please use my personal address for this one."
2. Urgency, Threats, and Requests for Secrecy
Red flag 3: A deadline designed to panic you. "Your account will be closed in 24 hours." "Payment must be authorised today." Genuine providers do send expiry notices, but they usually repeat them in the app or account dashboard, where you can confirm the claim without touching the email.
Red flag 4: Secrecy. "Please don't discuss this with anyone until it's signed." "Keep this between us for now." Legitimate business processes survive a phone call. Requests for confidentiality exist to stop you from asking the one person who would spot the problem.
3. Payment Requests That Skip a Step
Red flag 5: New bank details, wrapped in urgency. A real supplier's email thread gets hijacked, and a short reply arrives: "We've changed banks, please update your records before the next payment." The formatting looks perfect because it is a genuine thread. Always confirm account changes by calling a number you already have on file — never one printed in the email.
Red flag 6: An odd payment method or an odd amount. Gift cards, cryptocurrency, a transfer to an individual rather than a company, or a small "test payment" before the real one. Be equally wary of requests to split an invoice into smaller amounts, which is often an attempt to stay under an approval threshold.
4. Links, Attachments, and QR Codes
Red flag 7: The link does not go where the text says. Hover over a link on a computer, or press and hold on a phone, and read the destination. Shortened links hide it entirely. A login page that asks for your password and your one-time code is a strong signal that someone is harvesting both.
Red flag 8: Unexpected files and codes. Attachments you did not ask for — archives, disk images, HTML files that open a fake sign-in form, or documents that ask you to "enable content" — deserve suspicion. So do QR codes in emails and PDFs, which push you onto a phone where link previews are far weaker.
5. Small Details That Do Not Add Up
Red flag 9: The tone is off. A generic greeting from someone who normally uses your name. A signature with the wrong job title or a missing phone number. Mixed fonts, odd spacing, or a writing style that does not match the person supposedly sending it.
Red flag 10: The context is almost true. This is the hardest one. You really did order a parcel. You really do use that platform. The email simply attaches itself to something real. The fix is to leave the email and check the source directly — open the retailer's site or app yourself and look at the order, rather than following the link.
A 60-Second Check Before You Click
None of this requires special tools. It requires a pause and a habit.
- Stop. Do not reply, do not forward, do not click. Urgency is the attacker's main tool, so removing it costs them the most.
- Read the actual address, not the display name, and check the reply-to if you can see it.
- Verify out of band. Open the service in a new browser tab using a bookmark you already have, or call the person on a number you already know.
- Treat money and credentials as a two-person job. For any payment change or credential request, get a second pair of eyes before acting.
- Report it. Use your workplace "report phishing" button if there is one, then delete. Reporting protects the next person.
If You Already Clicked
It happens to careful people. Act quickly rather than quietly. If you entered credentials, change that password from a different device, sign out of active sessions, and turn on multi-factor authentication. If you approved a login prompt you did not expect, report it to your IT or security team immediately.
If money has moved, call your bank's fraud line straight away — speed matters more than embarrassment. For anything with financial, contractual, or legal consequences, speak to a qualified professional rather than relying on advice from an email thread or a search result.
One last habit worth keeping: slow down on the messages that push hardest. A genuine request can survive a five-minute delay. A fake one usually cannot.
Photo: BM Amaro / Pexels