Why phishing still catches us out

You might think you would never fall for a phishing email. The image of a badly written message from a deposed prince is hard to shake. But modern phishing is polished, patient, and often indistinguishable from the real thing at a glance. Criminals now copy logos, layouts, and legal footers with worrying accuracy. They may even reply to a genuine email thread you were already part of. The aim is usually one of three things: to steal your login details, to trick you into installing malware, or to persuade you to send money. The good news is that these messages nearly always contain small inconsistencies. Learning to spot them turns you from an easy target into a difficult one.

The four warning signs hiding in plain sight

Most phishing attempts give themselves away through one of four clues. Train your eye to check these before you do anything else.

• A mismatched sender address. The display name might say "Your Bank", but the actual email address behind it tells a different story.
• A link that leads somewhere unexpected. The text of a link can say one thing while the destination is entirely different.
• An unexpected request for information or money. If you were not expecting the message, treat any request for passwords, card details, or bank transfers as highly suspicious.
• Pressure to act immediately. Phrases like "within 24 hours" or "your account will be closed" are designed to stop you thinking clearly.

Add a generic greeting such as "Dear Customer" and an unexpected attachment, and you have a classic phishing recipe. None of these signs alone proves a scam, but two or more together should make you stop.

How to check a sender address without getting fooled

The display name in your email app is just a label. Anyone can set it to anything. What matters is the address after the @ symbol. On a desktop email client, hover your mouse over the sender name. On a phone, tap the name to expand the details. Look for a domain that belongs to the organisation. A message from a high street bank will never come from a free webmail address. Watch for misspellings too: a lowercase L switched for a capital I, a zero instead of an O, or an extra word like "-secure" or "-verify" slapped onto the end. These are easy to miss at a glance. Also check the "reply-to" address if your client shows it. Sometimes the sender looks fine, but replies are directed to a completely different account. If the sender address does not match the organisation exactly, do not trust the message.

Inspecting links before you click

Never click a link in an email unless you are certain it is safe. Instead, inspect it. On a computer, hover your cursor over the link without clicking. On a mobile device, press and hold the link to see a preview. You are looking for the real domain name, which is the part immediately before the first single forward slash after the protocol. For example, in https://www.yourbank.co.uk/secure, the domain is yourbank.co.uk. But in http://yourbank.co.uk.phishingsite.com/secure, the domain is actually phishingsite.com. The real bank name is just a subdomain of the criminal's site. Also be aware that a padlock icon and https:// only mean the connection is encrypted, not that the site is honest. Phishing sites can have padlocks too. If a message asks you to log in, do not use the link. Open your browser, type the organisation's address yourself, or use a bookmark you saved earlier. That way you know exactly where you are.

When a message asks for information or money

Legitimate organisations do not ask for sensitive information by email. Your bank will never ask for your full password, your PIN, or a full card number. Neither will a government department, the health service, a delivery firm, or your energy supplier. If an email asks you to "verify" your account by clicking a link and entering details, it is almost certainly a scam. The same goes for unexpected invoices, especially those with attachments ending in .html, .zip, or .exe. And be wary of any message that tries to change payment details. If a supplier or landlord suddenly emails to say their bank account has changed, phone them using a number you already have to confirm. Never use the contact details in the email. Urgency is a weapon. When you feel rushed, take a breath, close the message, and check independently. A genuine problem will not vanish because you waited ten minutes.

Simple habits that make you a harder target

Good security is built on small, repeatable actions. Turn on two-step verification for your email account. This means that even if someone steals your password, they still cannot get in without a second code. Use a password manager to create and store long, unique passwords for every site. Keep your browser, operating system, and antivirus software up to date. If you do click a suspicious link and enter your details, act quickly: change your password immediately, run a full malware scan, and check your email settings for any forwarding rules you did not create. Finally, report phishing messages using the "report spam" or "report phishing" button in your email app. It takes a second, and it helps protect everyone else. Trust your instincts. If an email feels slightly off, it usually is.