smartigoSpotting phishing: five questions that expose almost any scam message
You used to recognise scam emails by their clumsy wording. Those days are over. Many messages today are linguistically clean, nicely designed and carry the right logo. What remains are the patterns behind them, and those are surprisingly stable.
It's never about the link, it's about you
Phishing isn't a technical problem in the narrow sense. The sender wants you to do something: click, type a password, pass on a code, call back, transfer money. Everything else is decoration. Once you have that in mind, you don't have to memorise a list of a hundred features. Five questions are usually enough.
Question 1: Was I expecting this?
A parcel notification when you haven't ordered anything. An invoice from a company you were never a customer of. A message from a bank where you don't have an account. The classic fallacy goes: "It happens to fit me, so it must be real." Scammers spray widely, and with enough recipients it will fit a few of them. That it fits you proves nothing.
Question 2: Is it putting me under pressure?
"Your account will be locked in 24 hours." "Final reminder." "Suspicious activity detected." Time pressure and threat are the most common feature of all. They have a purpose: you're not supposed to think. Legitimate senders do set deadlines, but rarely a lock-out by tomorrow morning, and never without another way for you to sort things out.
Question 3: What exactly am I being asked to do?
If the answer is "enter data", be careful. Consumer protection organisations point out that banks don't ask for a PIN or a one-time code by email or phone. The same goes for passwords at big services. If a message contains a form, a login window or an attachment you weren't expecting, the same applies.
Question 4: Who does the address really belong to?
The display name is arbitrary. So is the part before the @. What counts is the domain: the last two building blocks of the web address, right before the first slash. An example:
www.mybank.com.account-security.info/login
That looks like "mybank", but it belongs to account-security.info. Everything to the left of it is just a name the operator made up. Read addresses from right to left, up to the first slash. On a phone you have to long-press the link to see the full address. That one second is worth it.
Question 5: Can I sort this out without the link?
This is the strongest question, and it works even if you can't see through anything else. Instead of tapping the link, you open the company's app or type the address yourself. If the reminder is real, it's there too. If it isn't there, that detour just saved you from a mistake.
Three messages to check
Read them and decide before you open the answers.
- Text: "Your parcel could not be delivered. Please confirm your address within 12 hours: parcel-delivery.info/p/4812". You aren't expecting a delivery.
- Email from your electricity provider, where you are a customer: "Your annual statement is ready." No link, just a note to log in to the customer portal you know from your bookmark.
- WhatsApp from an unknown number: "Hi Mum, my phone broke, this is my new number. Can you send me some money quickly?"
Answers
1) Phishing. You weren't expecting anything (question 1), there's a deadline (question 2), and the domain has nothing to do with a parcel carrier (question 4). 2) Probably fine. You expected it, there's no pressure, and you go via your own route (question 5). 3) A known scam, often called the "Hi Mum" or "Hi Dad" scam. Call the old number, or ask a question only your child could answer, before transferring anything.
What if it already happened?
It happens to people smarter than you. If you only tapped the link and entered nothing, close the page and breathe. If you entered login details, change the password straight away at the real provider, through its app or an address you type yourself. If bank details or a card were involved, call your bank or the card-blocking line. Consumer organisations also advise keeping the message as evidence instead of deleting it.
The habit of asking what a message is for can be practised. The thinking behind it is also covered in Training logical thinking.
Why clever people fall for it
A word of relief. People don't fall for phishing because they're stupid, but because the message arrives at the wrong time. Someone who sees something "urgent" on their phone at half past seven in the morning, between school drop-off and the train, has no capacity for scepticism right now. Senders know this and send at times when people are distracted, in a hurry or tired.
A plain but effective rule follows: don't deal with anything involving money, accounts or login details in passing. If a message is truly important, it will still be important in two hours. If not, you've just saved yourself a mistake. Many scams depend on you not waiting out the moment.
And one more thing helps: talk about it. If someone in the family or among friends says which message arrived again today, shame goes down and the pattern becomes visible. That your uncle fell for the parcel notification isn't a scandal, it's a conversation starter. People who are ashamed don't report. People who don't report get caught a second time.
Quick questions
Can I still spot phishing by spelling mistakes?
Sometimes, but don't rely on it. Many messages are linguistically flawless. Questions about pressure, expectation and intent are more reliable.
May I reply to a suspicious message to ask if it's real?
Better not. Ask through a route you know yourself: the app, the phone number from the official website, or your bookmark.
Smartigo has a small practice series for this: look at a message, decide, find out. No danger, no time pressure. The core features are free.