1. An Urgent or Threatening Tone
Scammers create a sense of panic to rush you into making a mistake. Emails that threaten to lock your account, impose a penalty, or demand immediate action are designed to bypass your critical thinking. Legitimate organizations rarely create this kind
of artificial pressure.
2. Unfamiliar or Mismatched Email Addresses
This is a classic but effective trick. Always check the sender's full email address, not just the display name. Attackers often use domains that are slightly misspelled (like 'micros0ft.com') or use a public domain (like '@gmail.com') for what should be an official company communication.
3. Suspicious Links or URLs
Hover your mouse over any link before you click it. A pop-up will show you the actual web address the link directs to. If the destination URL doesn't match the text or seems unrelated to the sender, it's a major red flag. Attackers disguise malicious links to lead you to fake login pages.
4. Requests for Sensitive Information
Your bank, your IT department, and government agencies will never email you to ask for your password, social security number, or financial details. Any unsolicited email requesting this type of confidential information is almost certainly a phishing attempt.
5. Generic Greetings
Emails starting with vague salutations like "Dear Valued Customer" or "Attention User" can be a warning sign. Companies you do business with will typically use your name. Generic greetings suggest the scammer is sending out mass emails, hoping someone will bite.
6. Unexpected Attachments
Be extremely wary of file attachments you weren't expecting, even if they seem to come from a known contact. These files, often disguised as invoices, reports, or résumés, can contain malware that infects your computer and network. Formats like .zip, .exe, or even seemingly harmless PDFs and calendar invites can be malicious.
7. An Offer That's Too Good to Be True
Emails promising lottery winnings, unexpected refunds, or unbelievable discounts are common phishing lures. These tactics play on human greed and curiosity. If an offer seems surprisingly generous or completely out of the blue, it's designed to trick you into clicking a malicious link or giving up personal data.
8. AI-Polished Language Without Errors
While poor grammar and spelling were once easy giveaways, AI has changed the game. Scammers now use AI to generate flawless, context-aware emails that mimic corporate communication styles. The absence of errors is no longer a sign of safety. Instead, look for context that feels slightly 'off'.
9. Unusual Internal Requests
Be especially cautious of emails claiming to be from a C-level executive or manager (a tactic known as 'whaling') asking for an unusual task, like purchasing gift cards or wiring funds. Verify these requests through a different communication channel, like a phone call or a direct message on a trusted platform.
10. Multi-Factor Authentication (MFA) Fatigue
If you receive a sudden flood of MFA push notifications that you did not initiate, do not approve them. This is an attack tactic called 'MFA fatigue,' where scammers who already have your password hope you'll accidentally or impatiently approve their login attempt just to make the notifications stop.
11. QR Code Phishing or 'Quishing'
A newer tactic involves embedding QR codes in emails. These codes bypass some email security filters. Scanning one with your phone can lead you to a malicious website designed to steal your credentials. Treat QR codes in unexpected emails with the same suspicion as you would a strange link.
12. A Vague Sense of 'Wrongness'
Sometimes an email just doesn't feel right. The request might be out of character for the sender, the branding might look slightly off, or the timing seems odd. Trust your instincts. This intuition is often your best defense, signaling you to pause and verify the message's legitimacy before proceeding.
