Most phishing emails don't arrive with typos and a fake lottery win. They arrive as a delivery update, a shared document from a colleague, or a payroll notice that looks like the real thing. The trick isn't memorising a list of scams; it's running the same quick check every time. Here's a routine that takes about 30 seconds — long enough to catch the usual tells, short enough that you'll actually do it.

The three questions that do most of the work

Before you click anything, ask: Who actually sent this? What does it want me to do? Where does the link really go? Nearly every phishing email fails at least one of those tests. You don't need to be a security analyst — you just need to slow down long enough to look.

Check the address, not the display name

The name shown in your inbox is just a label the sender chooses. Anyone can set it to "PayPal" or "HR Department". The real information sits in the address itself. On a computer, hover over or click the sender name to expand the details; on a phone, tap it. Then read the domain — the part after the @.

• A free mail provider hiding behind a corporate name, such as hr@company-hr-gmail.com
• A padded or misspelled domain: microsoft-support.co, paypa1.com, notices-paypal.com
• A detail that's slightly off — "rn" instead of "m", a "1" instead of an "l", an extra hyphen

If the message claims to be from a company you actually use, compare the domain with one from an email you know is genuine. Banks, utilities and delivery firms write to you regularly, so you have a reference point.

Look for pressure, not just bad spelling

Many phishing emails are written cleanly, in decent English, with your name in the greeting. What gives them away is the emotional push — they want you to act before you think.

Your parcel is being held at our depot. Pay the redelivery fee within 24 hours or it will be returned to sender.

You'll see the same shape elsewhere: "Your account will be closed in 24 hours." "Unusual sign-in detected — confirm now." "This invoice is overdue and goes to collections today." Legitimate organisations do send deadlines. They rarely demand that you click a link to fix a problem within the hour, and they don't ask for your password, your full card number or a login code by email. That last point matters most: one-time codes exist to protect you. Nobody legitimate needs you to type one into a page they sent you.

Check where a link actually goes

The underlined text can say anything. The destination is what counts.

• On a computer, hover over the link without clicking and read the address at the bottom of the window.
• On a phone, press and hold the link to see a preview.
• Read the address from right to left: the part directly before the first single slash is the real site.

So https://microsoft.com.account-verify.info/login actually goes to account-verify.info, and https://drive-google.com.shared-files.co/doc goes to shared-files.co. The trusted brand name is just decoration in front of the real domain.

Shortened links (bit.ly, tinyurl and similar) hide the destination by design, which is exactly why phishers use them. Treat them as unsafe in unexpected messages. And if a link opens a login page, don't use it. Open a new tab, type the company's address yourself, or use its app. If the alert is real, it will be waiting for you there.

Attachments and QR codes

Attachments are a common delivery route: an .html file that opens a fake login page in your browser, a .zip hiding an executable, or an Office document that asks you to "Enable Editing" or "Enable Macros" before it shows anything. If you weren't expecting the file, don't open it — and never enable macros for a document that arrived by email, even if it looks like it came from a colleague.

QR codes in emails are the same trick in a new wrapper. They push you onto a phone, where addresses are harder to inspect. If a message asks you to scan a code to log in or pay, go to the official website instead.

What to do in the next minute

1. Don't reply, and don't click anything else — including "unsubscribe".
2. Report it. Most mail clients have a Report Phishing or Report Junk button. At work, forward it to your IT or security team at the address they've given you.
3. Delete it. If you're unsure whether it's genuine, contact the organisation through a channel you looked up yourself — the number printed on your bank card, the website you typed in — never one supplied by the email.
4. If you entered details, change that password now, turn on two-factor authentication, and tell your IT team. If money is involved, call your bank immediately.

When money, contracts or personal data are in play, get advice from your bank or a qualified professional before acting on anything the message asks for.

Turning it into a habit

Thirty seconds feels like a lot when you're busy, but it's cheap insurance. Start with one check — the sender's real address is a good first habit — and let the rest become automatic. Within a week or two you'll catch the obvious fakes at a glance.

And when you do get caught out, say so quickly. Reporting a mistake limits the damage and protects the next person on the list. Nobody is immune; the people who stay safest are the ones who pause, check and tell someone.

Photo: RDNE Stock project / Pexels