Spotting a phishing attempt in five seconds

Check your starting point

Before you learn a new habit, you need to see the one you already use.

Think about the last time you hesitated over an email that asked you to click something, pay something, or "verify" something. How did you decide? Was it the logo, the writing quality, or just a gut feeling?

If your main filter is “it looks official” or “it came to my real address”, you’re in the same place as most people—and that’s exactly where modern phishing wins.

By the end of this article, your default will be different: every risky email will pass through three tiny checks before your finger hits the link.

The real threat model: what actually breaks households

You don’t need to defend against spy agencies. You do need to defend against criminals sending millions of cheap, automated messages.

Their goal is simple: get you to enter a password, card number, or code into a fake site. Then they use that data in credential stuffing attacks (trying your password on big sites), emptying accounts, or taking over your email.

Most of the damage in normal households starts with exactly that kind of small mistake: one rushed click on a fake login page.

So we’ll focus on defenses that work against:

We’re not trying to make you perfectly safe from every exotic attack. We’re trying to make it very hard to trick you, personally, into handing over the keys.

The three glance-checks: your five-second filter

You don’t need a forensics degree. You need three questions you can answer in seconds, before you click.

Use these only for emails that touch money, accounts, or identity (logins, payments, tax, shipping, subscriptions). For newsletters and memes, you can relax.

If an email fails even one of these checks, slow down. The right move usually isn’t to “investigate more” inside the email—it’s to go around it via the official app or website.

Live practice: three emails from your own inbox

Time for a real attempt.

1. Open your inbox on a laptop or phone.
2. Find three recent emails that ask you to click a button or link about money, shipping, or login; examples: “Your package is waiting,” “Unusual sign-in,” “Payment failed,” “Verify your account.”
3. For each email, give yourself ten seconds max to run the three checks:
   • Sender domain
   • Link target on hover / long-press
   • Urgent or threatening wording
4. Label each email in your head or on paper as:
   Confident safe

   Confident scam

   Not sure

Now look at your decisions.

Good feedback signals: you can point to concrete reasons like "sender is [email protected] and link matches https://bank.com/..." or "sender is [email protected] and the link goes to dhl-track-login.com; not right." You also caught the emails that shout deadlines or threats.

Weak feedback signals: you’re mostly saying "it looks professional" or "they used my name," or you don’t know how to see the full sender or link target. That just means you’re ready for the next pass.

The hover test: the safest click you can make

The single most useful move is also one of the safest: revealing where a link really goes without visiting it.

On a computer, move your mouse over the button or link, but don’t click. In most email apps and browsers, the true web address (URL) appears at the bottom of the window or in a small preview.

On a phone:

• In many email apps, long-press the link or button. A small panel should show the full address.
• If you only see a short preview, look for a “Copy link” option; paste it into a note to see the whole thing.

What you’re looking for is the domain—the core part before the first single slash.

Think of domains like street addresses and everything after the first slash like apartment numbers. If the street name is wrong, it doesn’t matter how nice the apartment number looks. Criminals bury fake sites in long, confusing addresses because they know most people never read past the logo and the first line of text. You’re going to be the small minority who actually glances at the street name.

If the domain doesn’t clearly match the brand you expect, stop. Don’t click through “just to see.” Go to the site or app yourself instead.

Why "official-looking" is almost worthless

Modern phishing kits copy real emails perfectly. Logos, colors, layout, even footers with addresses and copyright lines—all trivial to steal.

Attackers also use AI-written text, so the old “look for bad grammar” rule isn’t reliable anymore. Many fake emails now read better than genuine ones.

What’s still hard to fake is control of the real domain. Criminals can’t send from @hmrc.gov.uk or @apple.com at scale, so they use lookalikes: extra words, strange endings, or free webmail accounts.

When you judge an email by its design, you’re playing on their field. When you judge it by domain and hovering the link, you’re playing on yours.

What to do when something smells off

If an email fails your glance-checks, or you just feel uneasy, your next steps are simple.

1. 1
   Do nothing inside the email. Don’t reply, don’t click, don’t open attachments.
2. 2
   Go around it. Open the official app or type the website address you already know into your browser. If there’s really an issue, it will be visible there (e.g., a notification in your bank app).
3. 3
   Check another channel. For deliveries, use the courier’s official tracking page or app and your tracking number. For banks, call the number on the back of your card, not in the email.
4. 4
   Let it sit. Real problems don’t vanish if you wait an hour. Scams often rely on you acting before you can think.

If you confirm it’s fake, delete it. If your provider supports it, use the “Report phishing” option so their filters get smarter.

Modern phishing tricks; and what still gives them away

Today’s phishing campaigns often live on real infrastructure:

So what’s left for you to spot?

1. Domain mismatches. Even if the email comes through something that looks clean, the link may take you to an unrelated domain or a long, messy URL that hides the real host.

2. Context problems. "Your package is waiting" when you ordered nothing. A tax refund notice out of season. A bank you don’t use.

3. Overlapping urgency and access. The most dangerous emails combine scary time pressure with a request for login, payment, or document upload.

Whenever you see that combo, rush + login/payment, treat it as high risk, and move straight to the official site or app.

Upgrade your habits: making the checks automatic

The goal isn’t to think hard forever. It’s to make the three glance-checks automatic in the high-risk cases.

For the next week, any time you see an email about money, accounts, or identity, pause and run this mini-sequence in your head:

1. 1
   Sender domain? Does it match the brand exactly?
2. 2
   Hover / long-press link? Does the domain match what I expect?
3. 3
   Urgent or threatening? Are they trying to rush me?

If you notice that you keep forgetting to hover links, that’s useful feedback. Adjust your retry: for the next day, every time you open an email on your computer, practice hovering every link, even in harmless newsletters, just to build the muscle.

Judge your progress by fewer impulse-clicks and more intentional "go around the email" moments, not by eliminating every uncertain feeling.