Spotting a Phishing Attempt

It is ten to five on a Friday. The message says your account will be suspended within twenty-four hours unless you confirm your details, and it looks exactly like the twenty legitimate messages from that company you have already read this year.

Phishing does not beat your judgment. It beats your timing. It arrives when you are busy and manufactures a deadline so that you act before you check. The craft is in the details: a sender address one character off, link text that says one thing while the link points somewhere else, a reply-to that is not the sender, and a request to log in or pay right now. Give it twenty seconds of attention and the whole thing usually falls apart.

Two details separate a careful reader from a lucky one. The first is the reply-to header. A message can display a convincing sender and still route your reply to an address the attacker controls, so open the full headers before you answer anything about money. The second is the channel. The same script arrives by text and by phone, which the industry calls smishing and vishing, and a caller who already knows your employer and your manager sounds authoritative for about four seconds. If a request touches payments or credentials, verify it through a channel you started: a number you already had, an app you already installed.