How to Protect Yourself from Phishing Emails

Step by step

1. 1 min

   Inspect the sender's actual address

   Do not rely on the displayed sender name. Click or hover your cursor over the sender's name to reveal the full email address; if the domain does not match the organization it claims to represent, mark it as spam.

   Note: Scammers often use look-alike domains like @company-support.com instead of @company.com.
2. 1 min

   Scrutinize all embedded links

   Hover your cursor over any button or link without clicking to preview the destination URL in the bottom corner of your browser. If the destination URL differs from the legitimate website address or displays a suspicious string of characters, do not interact with it.

   Note: Use this method for every link, even those appearing in trusted brand communications.
3. 1 min

   Identify urgent or threatening language

   Phishing attempts rely on creating a false sense of panic or immediate urgency to bypass critical thinking. If an email demands an immediate password reset, threatens account suspension, or claims a suspicious login, treat it as a malicious attempt.

   Note: Authentic service providers typically do not demand sensitive information via email links.
4. 30 sec

   Scan for inconsistent formatting

   Check for poor grammar, misspellings, or low-resolution logos within the email body. Professional organizations maintain strict brand standards; deviations in design are primary indicators of fraudulent content.

   Note: Even one significant typo is sufficient grounds to flag an email as suspicious.
5. 30 sec

   Enable multi-factor authentication

   Navigate to your account security settings and enable Multi-Factor Authentication (MFA) using an authenticator app. Even if you accidentally disclose your password to a phishing site, MFA acts as a final barrier to unauthorized access.

   Note: Use app-based TOTP (Time-based One-Time Password) rather than SMS-based codes for higher security.
6. 30 sec

   Report and delete the threat

   Use your email provider's built-in 'Report Phishing' or 'Mark as Spam' button. This trains your email filter to recognize similar patterns in the future, then delete the message permanently.

   Note: In Gmail, select the three-dot menu and click Report Phishing.