Most computer users have seen a phishing email. But would you recognize one to be fake before it was too late? That question is harder to answer honestly than it was a few years ago — because the old clues are disappearing.
We’ve repeatedly seen the usual bank message, where they claim your accounts will be frozen unless you provide your credentials immediately. We’ve seen the parcel delivery failed notice, where a parcel is waiting for you to claim. Some of the more recent methods include a parking infraction notice or a photo radar speeding ticket. There are endless ways to grab our attention and make us want to click the link or open the attachment out of panic or curiosity.
Here’s what changed: the people writing these messages now have AI doing the writing for them. The spelling mistakes that used to give a fake email away are mostly gone. The logos look right. The message may even mention your name, your company, or a service you actually use. Judging an email by how professional it looks no longer works — the fakes look professional now.
So what still works?
Check where it actually came from.
You might see a legitimate-looking name in the “From” field, but if you hover over that name you should see the full email address. It most definitely is not going to match where the message appears to come from. Anyone can type any display name they like.
Ask whether you were expecting it.
Those who have fallen prey to these methods usually say they were afraid their bank accounts would really be frozen, or they were expecting a parcel. That is what the bad actors count on, and why they try to create urgency in their messages. Urgency is the tell that never went away: a message that demands you act immediately, and ideally tells you not to check with anyone first, deserves the most suspicion, not the least.
Don’t judge the email — verify the request.
If a message asks you to log in, pay, or share credentials, don’t use the link or number in the message. Go to the service directly, or call the sender on a number you already know. A short version of the same habit is P.A.U.S.E.: pause before you click, ask if it was expected, check the real web address, share with care, and escalate if it feels off.
Watch for the newer formats, too.
QR codes in emails and posters are a growing trick — scanning one can take you to a fake login page just as surely as clicking a link. Treat a QR code you weren’t expecting with the same suspicion as a link you weren’t expecting.
We often tell our clients: if your gut tells you it isn’t right, it probably isn’t right, and you should ignore it. Just remember to think twice before clicking on a message that could compromise your computer — and if you’re unsure, ask us. We’d rather look at a suspicious email with you than clean up after a click.