Recognizing Phishing Attempts Before You Click

Most people assume they’d never fall for a phishing attempt, convinced it only happens to people who aren’t paying attention. In reality, well-crafted phishing messages are designed specifically to exploit a moment of distraction, a busy morning, an urgent-sounding subject line, a context where pausing to verify feels like an unnecessary delay. Confidence that you’d always notice is itself part of what makes these messages effective.

What these messages try to trigger

Nearly all phishing attempts rely on a handful of emotional triggers rather than technical trickery: urgency, fear of a consequence, or the promise of something good happening if you act quickly. A message claiming an account will be suspended within hours, or that a payment failed and needs immediate attention, is built to short-circuit the normal instinct to slow down and check.

Common warning signs

1. A sense of urgency or a deadline measured in hours, pressuring quick action before you’d normally think something through.
2. A generic greeting instead of your actual name, especially from a service that would normally know who you are.
3. A request to click a link or open an attachment to resolve a problem you didn’t know existed until that message arrived.
4. A sender address that looks almost right but has an extra word, a misspelling, or an unfamiliar domain when you look closely.
5. A request for information a legitimate organization would never ask for over message or email, such as a full password or a one-time login code.
6. Slightly odd phrasing or formatting, even when the overall message looks professional at a glance.

The hover-before-you-click habit

On most devices, holding a cursor over a link, or pressing and holding on mobile, reveals the actual destination before you commit to opening it. This single habit catches a large share of phishing attempts, since the visible link text rarely matches the real, often unrelated, address underneath it.

When the message claims to be from someone you know

Compromised accounts sometimes send phishing messages to the real contact list of the person they belong to, which makes these especially convincing since the sender genuinely is someone you trust. An unusual request from a known contact, especially one involving money, gift cards, or urgent favors, is worth confirming through a separate channel, a phone call or a message sent outside the original conversation, before acting on it.

What to do if you’re unsure

• Don’t click any link in the message itself. Instead, go directly to the organization’s site by typing the address yourself or using a saved bookmark.
• Contact the organization through a phone number or address you already know to be legitimate, not one provided in the suspicious message.
• If you’ve already clicked something and entered information, change that password immediately and watch the related account closely for a while afterward.

Treating every unexpected urgent request with a brief pause, rather than an immediate reaction, is the single habit that prevents most phishing attempts from succeeding, regardless of how convincing the message looks on the surface.