How to Identify and Block Phishing Attacks in Windows

Step by step

1. 1 min

   Verify the sender address

   Open your email client and expand the sender details to view the full email address. Do not rely on the display name, as it can be easily spoofed. Inspect the domain after the @ symbol to ensure it matches the official organization's domain exactly.

   Note: A mismatch between the display name and the underlying email address is a primary indicator of phishing.
2. 1 min

   Analyze URL destinations

   Hover your mouse cursor over any link provided in an email or message without clicking it. Windows will display the destination URL in a small hover box, usually at the bottom left of your application window. Verify that the destination domain is legitimate and uses the HTTPS protocol.

   Note: Attackers often use URL shorteners or deceptive characters to mask malicious sites.
3. 2 min

   Enable SmartScreen protection

   Navigate to Settings > Privacy & security > Windows Security. Select App & browser control, then click Reputation-based protection settings. Ensure 'Check apps and files' and 'SmartScreen for Microsoft Edge' are toggled to On.

   Note: SmartScreen actively blocks known malicious websites and potentially dangerous downloads.
4. 1 min

   Scan suspicious attachments

   If you receive an unexpected document or file, right-click the file and select 'Scan with Microsoft Defender'. Do not open files from unknown sources, especially those that prompt you to enable macros or content upon opening.

   Note: Macros in Office documents are a common vector for deploying ransomware in Windows.
5. 1 min

   Verify account security settings

   Access your Microsoft account dashboard online to review active sign-ins and recovery methods. Ensure Two-Step Verification is enabled to prevent account takeover even if your credentials are compromised during a phishing event.

   Note: Authenticator apps are more secure than SMS-based recovery codes.