The advice most people carry about phishing is a decade out of date. Poor grammar, mismatched logos, and obviously wrong sender names were once reliable indicators. Generated text removed the first, asset scraping removed the second, and infrastructure abuse removed much of the third. What remains reliable is structural, not cosmetic.
Timing is now part of the attack
The most effective messages arrive when you are already expecting them: a delivery notice during a week you ordered something, an invoice during a live procurement, a password reset minutes after you requested one. Some of this is coincidence exploited at volume. Some of it follows a real compromise elsewhere, where the attacker is reading a genuine thread and replying into it. A message that fits your context perfectly deserves more scrutiny, not less.
Check the destination, not the display
Display names are arbitrary text. Hover a link and read the actual host, right to left: the real domain is the part immediately before the first single slash. Attackers rely on long, plausible-looking subdomains placed before a domain they control. On mobile, press and hold to preview rather than tapping.
Treat any message that creates urgency as unverified
Account suspension in twenty-four hours, an unauthorised charge to dispute now, a document expiring today. Urgency exists to prevent verification. The response is always the same: do not use the link or number in the message. Navigate to the organisation independently, or call the number printed on your card or statement.
Multi-factor codes are targets too
Modern kits proxy the real login page in real time, capturing your password and one-time code and passing them straight through. If a page asks for a code you did not just request, or if you receive push approvals you did not initiate, that is an attack in progress, not a glitch. Approve nothing and change the password from a different device. Passkeys and hardware keys resist this class of attack in a way SMS codes cannot.
Payment-detail changes need out-of-band verification
For businesses, the most expensive single variant is an email — often from a genuine compromised account in a real thread — announcing new bank details for a pending payment. The control is procedural, not technical: any change to payment details is verified by calling a number you already held, never one supplied in the message. Make it a rule that applies regardless of who appears to be asking.
If you entered credentials
Change that password immediately from a clean device, starting with email, then revoke active sessions and reset any account sharing that password. Check mail rules and forwarding settings — attackers commonly add a quiet forwarding rule to maintain access after the password changes, and it is the step most often missed.