How to spot a phishing attempt before you click
By Ellis Blackwood · Subproject Zero
Falling for phishing isn't about being naive. It's about being in a hurry. The trick doesn't attack your intelligence — it attacks your moment: it arrives while you're distracted, pretends to be someone you trust, and rushes you so you don't stop to think.
What phishing actually is
It's a message — email, text, DM — pretending to come from someone trustworthy (your bank, a company, even a friend) to get you to do something: click a link, hand over a password, pay. It doesn't break any lock. It convinces you to open it.
The signs that don't lie
Urgency and fear. "Your account will be locked in 24 hours." Pressure is the weapon: it wants you to act before you think.
They ask for data or money. No serious bank asks for your password by email. If they ask, that's already the tell.
The sender doesn't add up. Look at the real address, not the display name. One changed character is enough.
The link doesn't go where it says. Hover over it (or long-press on mobile) and read the real URL before you touch anything.
Let's be honest: it's not so obvious anymore
The old advice to "watch for spelling mistakes" is dead. Today a phishing message can be perfectly written, with the exact logo and an identical cloned site. Trusting how it looks is no longer enough. That's why the one truly reliable sign isn't in the message at all.
The rule that never fails: never act from the message. If your bank "writes to you", don't touch its link — open the app yourself or type the address by hand. If it's real, you'll see it just the same by logging in on your own.
What to do
1. Don't click. Go to the source yourself. Open the official app or site on your own, not through the link they sent.
2. Verify through another channel. A weird message from a friend or your bank? Call or ask through a route you already knew.
3. Turn on two-step verification. That way, even if they stole your password, they'd still be missing the second step.
4. If you already clicked, change that password right away (and anywhere you reused it) and switch on the second factor.
The bigger principle
Phishing exists because there's a message to slip through. The fewer channels that can be impersonated, and the less of your data is spread around, the less anyone has to fool you with. It's the same idea of reducing points of failure: that's why a second factor, never reusing passwords, and choosing tools that don't ask for data that can later be used against you all matter.
It's not about distrusting everything. It's about never deciding in a hurry inside a message you didn't ask for.