A phishing email rarely announces itself. It looks like a Tuesday: an invoice from a supplier, a shared document from a colleague, a password reset you might have triggered. In an office, you could lean over and ask the person next to you whether they really sent it. Remote and hybrid work removed that shortcut. What remains is your screen, your inbox, and a message built to rush you.

Phishing has tells. They are not dramatic, and they shift a little from campaign to campaign, but they repeat. Here is a fifteen-point checklist you can run through in under a minute before you click anything.

The 15-Point Checklist

Sender and identity

1. Check the actual address, not the display name. "Microsoft Support" or "HR Team" is just text someone typed. The domain after the @ is the only claim you can test.
2. Look for lookalike domains. Watch for rnicrosoft.com, paypa1.com, extra hyphens, and brand names buried in a subdomain, as in login-microsoft.com.auth-check.net.
3. Compare Reply-To with From. If they differ, your reply goes somewhere else. Some clients only show this when you hover or open message details.
4. Question free mail accounts in a business context. A message claiming to come from payroll, your bank, or a supplier you work with should not arrive from a personal mailbox.

Language and tone

1. A deadline measured in minutes. Real business rarely collapses if you take ten minutes to verify something.
2. Fear plus authority. "Your account will be suspended." "Final notice." "This must be completed before payroll closes." Pressure is the product.
3. Secrecy. "Please keep this between us for now." That instruction exists to stop you asking a colleague whether the request makes sense.
4. Details that don't quite fit. A project name spelled wrong, a job title you never held, or a greeting that is both generic and oddly formal from someone who normally uses your first name.

Links

1. Hover or long-press before you click. On a phone, press and hold the link and read the full address before letting go.
2. Read the domain from right to left. The real destination sits just before the first single slash. In https://login.yourbank.com.secure-auth.example.net, the site is example.net.
3. Treat shortened links and QR codes as sealed envelopes. A QR code in an email is simply a link you cannot inspect on the screen. If you must use it, scan with an app that previews the URL first, or type the site address yourself.

Attachments

1. Ask whether you expected it. Invoices, receipts, shipping notices, résumés, and "scanned documents" are the most common carriers. If you weren't waiting for it, confirm through another channel first.
2. Know the file types that should slow you down. .html, .htm, .zip or .rar archives, .iso, .lnk, macro-enabled Office files (.docm, .xlsm), and anything with two extensions such as invoice.pdf.exe. PDFs and plain images are lower risk, but they can still hold a link to a fake login page.

Context and timing

1. Notice when it lands. A request from an executive at 6 a.m., on a Friday afternoon, or during a busy launch is timed to catch you moving fast.
2. Beware of hijacked threads. A familiar conversation can suddenly turn to updated bank details, a new payment route, or a file you should open right away. When money or credentials change hands, verify by phone using a number you already have.

How to Check a Link in Two Seconds

A link can look convincing in the blue text and completely different in the destination. Hovering costs nothing. On a desktop, move the cursor over the link and watch the bottom corner of the window. On mobile, press and hold, then read the preview that appears.

Then read it like a domain, not a sentence. Everything after the first single slash is a path someone else controls. Subdomains can be named anything, which is why attacker-created addresses like accounts.google.com.verify-session.info are possible: the part that matters is verify-session.info, not the reassuring words in front of it.

Two more habits help. First, do not treat the padlock or HTTPS as proof of anything; most phishing sites have valid certificates now. Second, if you have a password manager, notice whether it offers to fill the login. It matches on the exact domain, so it stays silent on a lookalike site. That silence is useful information.

Attachments: Handle With Care

If an attachment arrives from an unknown sender, the safest move is often to ask for the content in the body of the message instead. If it comes from someone you know, a quick chat message such as "did you just send me a spreadsheet?" takes ten seconds and settles it.

Be especially careful when an archive asks for a password in the email itself. Legitimate senders sometimes do this, but it is also a standard trick for slipping past scanners. And if a "shared document" link asks you to sign in with your work email and password before you can view it, you are almost certainly looking at a copy of a real login page.

Pressure Is the Payload

Not every attack needs you to open a file. Some only need you to approve something.

Multi-factor authentication fatigue works by repetition: a stream of push notifications arrives until you tap Approve just to make it stop. Never approve a prompt you did not trigger. Report it, because it means someone already has your password.

Consent phishing is quieter. A legitimate-looking app asks for permission to read your mail and files, and you click Accept. No password is stolen and nothing looks broken, but access is granted. Read the permission list before approving anything.

If a message needs you to act immediately, that is the reason to slow down.

Habits That Work for Hybrid Teams

• Agree on a second channel for anything involving money, credentials, or personal data. Chat, a phone call, or a ticket, but not a reply to the email.
• Share suspicious messages in a team channel. One report often protects a dozen people.
• Report rather than delete. Security teams use reports to block domains and warn everyone else.
• Keep personal and work accounts separate, and never reuse a work password elsewhere.
• When a request feels wrong, say so out loud. Remote workers second-guess themselves far more often than they over-report.

If You Already Clicked

Do not panic and do not hide it. A fast report limits the damage; a silent click gives an attacker hours of quiet access.

1. Report it to your security or IT team immediately, even if you are not sure it was malicious.
2. Change the password for the affected account from a different device, and change it anywhere you reused it.
3. Sign out of active sessions and review your registered MFA methods for anything you don't recognise.
4. If you entered payment card or bank details, contact your bank or card provider using the number on their website and follow their fraud process. Seek professional advice if money has already moved.
5. Expect follow-up. A first click often leads to a more targeted message a day or two later.

A Routine You Can Actually Keep

You will not run fifteen checks on every message, and you don't need to. Build three habits and most phishing dies at the door: check the sender domain, hover over links before clicking, and verify anything involving money or passwords through a channel you chose yourself.

Pick one thing to start with this week, maybe the link hover, and make it automatic before adding the next. Teams that share what they spot get better at spotting it. The goal is not suspicion of everything; it is a short, calm pause at the exact moment a message is trying to remove it.

Photo: cottonbro studio / Pexels