For years, the standard phishing advice was "look for spelling mistakes." That advice is now actively dangerous. Attackers can generate fluent, well-formatted, context-aware messages in seconds, in any language, tailored to a specific company or role. A clean email proves nothing.
What still works is training people to notice behavior and mismatch rather than polish. Here are nine signs that hold up — and a short habit that turns them into a reflex.
The nine signs
1. The sender's address almost matches. Check the actual address, not just the display name. Look for swapped characters (examp1e), extra words (example-support.com), or unfamiliar top-level domains.
2. Manufactured urgency. "Within one hour," "immediately," "final notice." Pressure is the attacker's main tool because it short-circuits the pause where you'd notice something's off.
3. A threat or a reward. Lost access, a frozen account, a legal notice — or the reverse, an unexpected prize or refund. Both aim to provoke a fast emotional reaction.
4. A request that bypasses normal process. Payment details changed by email, gift cards, an "urgent" wire transfer from an executive, credentials entered via a link. Real finance and IT teams have processes; messages asking you to skip them deserve suspicion.
5. The link's real destination doesn't match its label. On a computer, hover to preview the actual URL before clicking. On mobile, press and hold. Be wary of URL shorteners and of domains that merely contain a trusted name (yourbank.login-secure.example).
6. Unexpected attachments, especially archives, macro-enabled documents, or "invoices" you weren't expecting.
7. A QR code asking you to scan. QR-code phishing (sometimes called quishing) moves the malicious link out of text where filters and eyes can inspect it. Treat unsolicited QR codes in email like unsolicited links.
8. A reply-to or context mismatch. The message claims to be from a colleague but the reply goes elsewhere, or the topic doesn't fit the relationship. Ask: would this person really contact me this way about this?
9. It arrives through a channel you can't verify. Phishing isn't only email. Text messages, chat messages, and even voice calls that imitate someone you know — including AI-generated voices — are part of the same pattern. The defense is the same: verify through a separate, known channel.
The one-minute check
Teach one habit, not nine rules:
- Pause. If a message is trying to rush you, that's the signal.
- Check who and where: the real sender address and the real link destination.
- Verify out of band. Call the person using a number you already have, or open the service by typing its address yourself.
- Report, don't just delete. One reported message can protect the whole organization.
What to do if you clicked
Speed matters more than embarrassment. Tell your security team immediately. If you entered a password, change it right away from a trusted device and revoke active sessions where possible. If you opened an attachment, disconnect the device from the network and wait for guidance. Organizations that make reporting safe and blame-free catch incidents far earlier than ones where people hide mistakes.
Technical controls help, but people are the last layer
Email authentication (SPF, DKIM, DMARC), link and attachment scanning, and multi-factor authentication all reduce risk. Phishing-resistant MFA, such as hardware security keys or passkeys, helps even when a user is fooled into entering a password, since there's nothing reusable to steal. But some messages always get through, which is why the human layer matters.
Why awareness training often fails — and what works
Annual slide decks don't change behavior. Short, regular, realistic practice does: simulated phishing paired with immediate, non-punitive feedback, tailored to the roles that are targeted most. We dig into this in why security awareness training fails.
If you want training built around your people's real inboxes, see our Phishing and Social Engineering Defense course and our broader Security Awareness for Employees program, or get in touch to tailor one to your organization.