I actually clicked a phishing link once, fully, all the way through to a fake login page, and typed in my actual email password before something finally made me pause, hand hovering over the submit button, staring at the page for a second too long and just feeling like something was off in a way I couldn’t immediately articulate. I didn’t hit submit. I closed the tab, changed my password immediately out of pure paranoid caution, and sat there for a good ten minutes afterward feeling genuinely rattled by how close I’d actually come, given how careful I generally think of myself as being with this exact kind of thing. That email had looked, at a glance, exactly like a routine security notification from my email provider, and it’s the reason I now actually slow down and check things properly rather than trusting my gut instinct alone, because apparently my gut instinct was one careless click away from getting fooled that day.

The sender’s actual email address is the first thing I check now, every single time, rather than just glancing at the display name shown in my inbox, because display names are trivially easy to fake and mean genuinely nothing on their own. That phishing email that nearly got me had a display name reading something like “Account Security Team,” which looked completely legitimate at a glance, but when I actually clicked to expand and see the full email address behind that name, it was some genuinely random string of characters at a domain that had absolutely nothing to do with the actual company it was pretending to represent. I make a point now of always expanding that sender detail before doing anything else with a suspicious-looking email, and it’s honestly caught several attempts since that I would have otherwise just trusted at a glance the way I nearly did that first time.

Urgency and fear are the emotional levers phishing emails lean on most heavily, and once you start actually noticing this pattern deliberately, it becomes almost comically obvious across nearly every phishing attempt you encounter afterward. “Your account will be suspended in 24 hours,” “unusual activity detected, verify immediately,” “your payment failed, update your details now or lose access” — these messages are specifically engineered to trigger a rushed, panicked reaction that short-circuits the kind of careful thinking that would normally catch something being off. The email that nearly got me used almost exactly this framing, warning that my account would be permanently locked within a set window unless I verified my login immediately, and I genuinely remember feeling that specific spike of anxiety it was designed to produce, which in hindsight is precisely the emotional state phishing relies on to work. Legitimate companies, in my experience since paying much closer attention to this, very rarely create that same manufactured, ticking-clock urgency around routine account matters, and when something does push that hard for an immediate reaction, I’ve trained myself to treat that pressure itself as the actual red flag, separate from anything else in the email.

Generic greetings are another thing I check for now, though I’ll admit this one’s become a slightly weaker signal over time as phishing attempts have genuinely gotten more sophisticated about personalizing themselves. Older, cruder phishing emails would open with something like “Dear Customer” or “Dear User,” rather than your actual name, which was an easy tell once you knew to look for it. More recent, better-targeted attempts sometimes do actually use your real name, pulled from data breaches or public information, which honestly makes this particular signal less reliable than it used to be, and I think it’s worth being honest that phishing tactics evolve specifically to defeat whatever advice becomes common knowledge, which is exactly why I’ve come to rely more heavily on the sender address and link-checking habits below rather than any single tell on its own.

Hovering over links before actually clicking them, without clicking, just letting your cursor rest on the link so your email client or browser shows you the actual destination URL in a small preview, usually in the bottom corner of the screen, is genuinely one of the most useful habits I’ve built since that whole incident. The link text in that phishing email displayed something that looked exactly like my email provider’s normal login page, but hovering over it revealed the actual underlying URL pointed somewhere completely unrelated, a domain I didn’t recognize at all, with a string of random characters tacked onto the end that had nothing to do with any legitimate login flow I’d ever actually used. I do this now for basically every link in every email that’s asking me to log in or verify anything, and it takes maybe two extra seconds, which feels like an absurdly small price for catching something that could have otherwise cost me a genuinely compromised account.

Attachments deserve their own specific caution too, separate from links, because I think people sometimes focus entirely on suspicious links while treating attachments as somehow inherently safer, which really isn’t the case at all. An unexpected attachment, especially one with a file extension like .exe, .scr, or even a Word document requesting you “enable macros” to view content properly, which is a genuinely common malware delivery method disguised as a routine document, should be treated with real suspicion, particularly if you weren’t expecting that specific file from that specific sender. I’ve gotten into the habit of specifically not opening any attachment I wasn’t already expecting, regardless of how legitimate the surrounding email looks, and if something genuinely seems important, I’ll actually contact the supposed sender through a separate, known channel, like calling them directly or messaging them through a platform I already trust, rather than engaging with the attachment itself at all.

Spelling and grammar mistakes used to be one of the more reliable tells, and honestly still catch a meaningful number of less sophisticated phishing attempts, the kind with genuinely awkward phrasing or obvious typos that a real corporate communications team would never let through. But I want to be honest that this signal has become noticeably less reliable in recent years, since more competent phishing operations now produce genuinely clean, professional-sounding emails that read exactly like legitimate corporate communication, sometimes even better written than some actual companies’ real emails, which is a slightly unsettling realization once you actually sit with it.

If I’m honest about the single habit that’s actually protected me most consistently since that whole close call, it’s not any individual checklist item so much as building in a mandatory pause before acting on anything urgent-sounding that arrives by email, regardless of how legitimate it looks at first glance. I now have a rule for myself, genuinely non-negotiable at this point, that I never click a link directly from an email claiming account trouble, ever, under any circumstances. Instead, I open a new browser tab myself, manually navigate to the actual company’s website by typing the address directly, and log in there to check if there’s actually any real issue with my account. It adds maybe thirty seconds to my day on the rare occasion a genuine account notification does show up, and it’s completely, permanently closed off the exact vulnerability that phishing email nearly exploited that afternoon, sitting there with my cursor hovering over a submit button I’m genuinely relieved I never actually pressed.