How Phishing Works and What to Look For

How to Spot Phishing

The fastest way to improve phishing detection is to stop looking for a single magic sign. Look for a story that does not add up.

• Does the sender identity really belong to the claimed organization?
• Do the links go where the email implies they go?
• Is the message pushing urgency, payment, delivery trouble, or account fear?
• Does the route look normal for the sender's claimed infrastructure?

Language and Pressure

Phishing often leans on urgency: verify now, payment failed, delivery missed, account suspended, unusual login, invoice overdue. The point is not just to inform. The point is to collapse the recipient's decision time.

Sender Tricks

Attackers abuse display names, reply paths, and fresh domains to look familiar enough for a quick glance. A believable brand name on top of an unrelated domain is one of the oldest and still most effective tricks.

Link Tricks

Links can hide the real destination behind a redirect, a tracking domain, an unrelated host, or a raw IP address. Some attacks use a harmless-looking first click that bounces the victim to the final fake site later.

Lookalike Domains

A lookalike domain is a domain that visually resembles a real brand or service but is not actually the same. That may involve a single changed character, a different word order, or a misleading subdomain.

Fake Login Pages

Fake login pages are built to capture usernames, passwords, MFA codes, or session approvals. They often copy the branding and layout of a real provider closely enough to feel familiar.

Fake QR Codes

QR-code phishing works by moving the dangerous step onto a phone. The email tells the victim to scan a code to review a document, approve a login, unlock a voicemail, or complete MFA. The scan lands on the attacker's page.

Before scanning, ask the same questions you would ask about a link: who sent this, why now, and where is this really taking me?