Spotting Scams and Phishing

A long password and a second factor protect an account right up to the second the account holder types them into the attacker's page. That is the entire trick in this lesson. The passwords lesson built a strong lock and put the key somewhere safe. Phishing does not pick the lock. It walks up to the person holding the key, tells a good story, and asks them to open the door. Strong passwords do nothing if the person types them into a fake page, so this is where the attacker skips the cryptography and goes straight for the human.

One con, three channels

Phishing, vishing, and smishing are the same move wearing three different costumes. Phishing arrives by email or a web page. Vishing is the same play over a phone call, where a live voice adds pressure. Smishing comes as a text message, where a short link hides the real address. The channel changes. The script does not.

Every version runs the same three steps. The attacker manufactures urgency, so the target acts before thinking. The attacker impersonates someone the target already trusts, a bank, an employer, a delivery company, a coworker. Then the attacker asks for one small thing: click this link, open this file, or read back this code. The urgency is the engine. A message that says an account will be closed in fifteen minutes is not trying to inform anyone. It is trying to shrink the window in which a person might stop and check.

The dangerous part is that none of this requires a technical flaw. The email server is fine. The phone network is fine. The attack targets attention and trust, which are harder to patch than software.

The tells

A fake message leaves fingerprints. The most reliable one is the sender address, not the display name. Mail apps show a friendly name like "PayPal Security," but the address underneath might read service@paypa1-support.com. Attackers register look-alike domains that swap a letter for a digit, add a hyphenated word, or bury the real brand in a subdomain: micros0ft.com, apple-id-verify.com, account.google.com.secure-login.ru. The brand name appearing somewhere in the address proves nothing.

Urgency and fear ride along with almost every one. "Suspicious login detected." "Your account will be suspended." "Final notice." The emotion is the payload, because a scared person clicks faster than a calm one.

Unexpected attachments are another flag. An invoice nobody ordered, a resume from a stranger, a file named Document.pdf.exe or a macro-enabled Payroll.docm. A file that arrives out of nowhere and wants to be opened right away deserves suspicion by default.

The last two tells are the ask itself. A message whose link text says one thing while the real destination says another is trying to mislead. And any message that asks for a login code, a password, or a payment through the link it provided has crossed the line that real institutions do not cross.

Reading a link before the click

The visible text of a link and its real destination are separate things. A link can display the words https://accounts.google.com and still point anywhere the author chose. Never trust the display text. Read the destination.

On a computer, hovering the mouse over a link shows the true address in the corner of the browser, no click required. On a touchscreen, a long press opens a preview of the same address. The skill is reading that address correctly, and the rule is to read the domain from the right. The real site is the registrable domain, which is the last two labels sitting just before the first single slash. In accounts.google.com.secure-login.ru/verify, everything to the left is decoration. The site is secure-login.ru. The words "accounts" and "google" are subdomains the attacker added for free.

Shortened links hide the destination entirely. A bit.ly or a QR redirect gives no domain to read at all. Two free, reputable services expand and inspect a link without visiting it in a normal browser: urlscan.io loads the page in a sandbox and shows where it ends up, and VirusTotal checks a URL or file against dozens of reputation engines. Both are worth keeping bookmarked.

A password manager quietly helps here, and it is worth understanding exactly how.

The one-time code and the callback rule

A legitimate bank, tax office, or online service never phones a customer and asks them to read back a one-time code. The code exists to prove identity to the service, not to a caller. So a caller asking for it is not verifying anything. They are sitting on the real login page, have already entered the stolen password, triggered the code to the victim's phone, and now need the victim to speak it aloud so the attacker can type it in and finish the login. The request itself is the proof of fraud.

This is also why some second factors resist phishing better than others. A code from an authenticator app such as Aegis or Google Authenticator is stronger than a code by text message, because SMS can be intercepted or SIM-swapped. But a real-time phishing kit relays either kind of code the instant the victim enters it, so both remain phishable. Passkeys and hardware security keys such as a YubiKey close that gap. They use the FIDO2 standard, which binds the credential to the real website's domain, so the browser refuses to hand it over on a look-alike site. There is no code for a human to read aloud and nothing for a fake page to relay.

The defense that covers every version is older than any of this technology. Hang up, or close the message, and reach the institution through a number the attacker did not supply. The number printed on the back of the bank card. The address typed by hand into a fresh browser tab. This is the callback rule, and it works because it moves the conversation onto a channel the attacker does not control. Verify out of band, always.

The modern twists

The classic fake email still works, but three newer variants trip up people who think they already know the game.

Fake login pages have grown from crude copies into pixel-perfect clones. Some sit behind a reverse proxy that forwards keystrokes to the real site and steals the live session cookie, which sidesteps a password and a second factor at once. The tell is still the domain in the address bar, not the look of the page, so the habit of reading the address from the right is the thing that saves the day.

QR-code scams, sometimes called quishing, move the attack off the screen. A sticker pasted over the real QR code on a parking meter, or a code printed in an email, sends the camera to a malicious site. A phone's camera app shows the destination URL as a preview before opening it, and that preview is the moment to read the domain. An unfamiliar address printed on a public sticker is a reason to stop, not tap.

Consent-phishing is the sneakiest, because it steals nothing that looks like a password. The attacker sends a genuine Microsoft or Google permission screen, the real one, asking to "Allow" some app access to email and files. The victim clicks Allow, and the attacker walks away with an access token instead of a password. A second factor does not help, because no password was ever entered. The defense is to read what an app is actually asking for, refuse anything unfamiliar, and periodically review connected apps in account security settings and revoke the ones nobody recognizes.

The calm default

Every technique in this lesson leans on one thing: a target moving fast. Urgency is the manufactured part of the message, the piece the attacker added on purpose. A real deadline survives a five-minute pause. A real bank is happy to be called back. A real delivery company does not need a card number to drop a box. Slowing down costs almost nothing and defeats most of this outright.

So the default response to any message that pushes for a click, a code, or a payment is to stop and verify through a channel the message did not choose. Open a new tab and type the address by hand. Call the number already saved in the phone, not the one in the text. Ask the coworker in person. The attacker's whole plan assumes that step never happens.

The reason a scam text knows a real package is coming, or a call names a real bank, is that the attacker rarely guesses. The opening line is built from details about the target that were collected, bought, or scraped long before the message arrived. The next lesson, your-data-trail, follows that exhaust: the trail of data that everyday online life leaves behind, and how much of a convincing pretext is sitting in it for anyone willing to pay.