The misspelled Nigerian-prince email is dead. Modern phishing is fluently written (AI handles that now), correctly branded, and arrives looking exactly like the message your bank, boss or delivery service would send. What hasn’t changed is the underlying mechanic — and that’s the part you can reliably detect.
Every phishing attack combines urgency + an action involving your credentials or money. The single habit that defeats nearly all of it: when a message asks you to log in, pay or verify, don’t click the link — navigate to the site yourself. And never read out a verification code to anyone.
The one pattern under every scam
Every phishing attack, regardless of polish, combines urgency + an action involving credentials or money. “Your account will be suspended — verify now.” “Your package is held — pay the customs fee.” “This is the CEO — wire this today, quietly.” The emotional spike is the tell; legitimate organizations almost never need you to act in the next ten minutes, and they never mind you taking a slower, independent route to respond.
The golden rule: never travel the link you were sent
This single habit defeats nearly all phishing: when a message asks you to log in, pay or verify — don’t click; navigate independently. Open the bank’s app, type the company’s address yourself, or call the number on the back of your card. If the alert is real, it’ll be visible from inside your account. If it isn’t, you just sidestepped the entire attack without needing to analyze anything.
What to check when you do inspect
The sender’s actual address, not the display name (tap or hover to expand it — “Apple Support” sending from a random domain ends the analysis). The link’s real destination (long-press on mobile, hover on desktop) — scammers rely on lookalike domains and URL shorteners. Generic greetings on supposedly personal account matters. And any request to move money, buy gift cards, install software or share codes — each of those is a fire alarm on its own.
The newer variants worth knowing
| Scam type | What it looks like | The defense |
|---|---|---|
| Smishing | Texts about deliveries, tolls, banks | Your postal service doesn’t collect fees by text |
| Quishing | QR codes in emails or on meters | Treat QR codes like links from strangers |
| Voice cloning | Calls sounding like family in trouble | Agree a family code word; call back on the real number |
| MFA fatigue | Repeated login push notifications | Never approve a prompt you didn’t start |
For MFA fatigue specifically: if approval prompts keep arriving, change the password immediately — someone already has it and is hammering the door.
One more: the “verification code” scam
Nobody legitimate will ever ask you to read them a code that was texted to you. Not your bank, not Microsoft, not the marketplace buyer. That code is the key to your account — anyone requesting it is stealing it, in real time, with you as the accomplice.
If you already clicked
Acted on a phishing link? Move fast and skip the shame: change the affected password immediately (and anywhere it’s reused — then fix the reuse with a password manager), enable two-factor if it wasn’t on, watch the account’s activity, and if money or card numbers are involved, call the bank now — early reports recover funds surprisingly often. Phishing works on intelligent people through timing and emotion; the defense isn’t being smarter than the scam, it’s having habits the scam can’t route around.
Frequently asked questions
How can I tell if an email or text is a phishing scam?
Look for the universal pattern: urgency combined with a request involving your credentials or money. Legitimate organizations rarely demand action within minutes. Check the sender’s real address (not the display name) and the link’s true destination, and be suspicious of any request to pay, share a code, or install something.
What is the single best way to avoid phishing?
Never use the link you were sent. When a message asks you to log in, pay or verify, go to the site or app independently — type the address yourself or open the official app. If the alert is genuine, you’ll see it inside your account; if not, you’ve avoided the attack entirely.
Should I ever share a verification code someone asks for?
No. No legitimate company, bank or buyer will ever ask you to read back a code that was texted to you. That code is the key to your account, and anyone requesting it is stealing access in real time.
What should I do if I already clicked a phishing link or entered my details?
Act immediately: change the affected password and any place you reused it, turn on two-factor authentication, and watch the account for unusual activity. If money or card details were involved, call your bank right away — quick reports often recover funds.