Phishing: spot it in 10 seconds

Check four things in order: the real sender address (not the display name), every link by hovering (domain first, spelling second), manufactured urgency («in 24 hours your account closes»), and unexpected attachments or QR codes. One miss out of four is enough to delete the message.

Clicked anyway? Do not hide it: disconnect, change the password from a clean device, revoke sessions, and enable two-factor authentication before the stolen password gets used. Speed beats shame — the first hour decides the damage.

Spear phishing is personal

Generic blasts are easy; targeted ones quote your boss, your project and your tools, scraped from social networks and leaks. The tell is still the action: an unusual request arriving by an unusual channel («urgent wire, reply only by mail»). Verify through a second channel you open yourself — call the number from the directory, not from the message.

Train the reflex

Forward real phish to your team chat when you catch one: ten shared examples teach more than any yearly course. Run a fake campaign twice a year and measure the click rate trending down, not the shame of clickers. People who report fast are the immune system — reward the reports, never punish them.