Signs that reveal a phishing email
A sender whose domain does not exactly match the organization's, artificial urgency (your account will be blocked today), generic greetings, writing errors, links whose real destination differs from the visible text, and requests for credentials or payment data. No single sign confirms fraud; several together do.
Why today's phishing is harder to spot
Poor writing is no longer a reliable indicator: with language models, messages arrive well written and personalized using the victim's public data. The file formats used as bait have also changed, with HTML and SVG attachments and QR codes that evade traditional email filters.
What to do with a suspicious email
Do not click or reply, verify through an independent channel by typing the official address or calling a known number, and report it to the security team. Reporting is the most valuable action: it lets the campaign be blocked for the rest of the organization before anyone falls for it.
