Phishing Email Red Flags: Quick Reference
This is a concise reference card for the most common phishing techniques. Print it, post it near workstations, or include it in employee training materials.
10 Techniques Phishers Use
- Spoofed sender addresses – Forged email addresses with subtle character swaps (rn for m, 1 for l, .co for .com)
- Homoglyph URLs – Links using look-alike characters from Cyrillic or Greek alphabets that redirect to fake sites
- Hijacked real accounts – Messages sent from legitimately compromised accounts, making standard filters useless
- Personalized targeting – Content pulled from your LinkedIn, social media, or leaked databases to make the message seem relevant
- HTTPS on fake sites – Phishing sites with valid SSL certificates and padlock icons that mean nothing about legitimacy
- Manufactured urgency – “Your account will be locked in 24 hours” or “Immediate action required” language designed to bypass your judgment
- Disguised attachments – Malicious code hidden in PDFs, Word docs, or Excel files that look like invoices or reports
- Cloned brand emails – Pixel-perfect copies of real emails from Microsoft, Google, DHL, or your bank with swapped links
- Auto-inserted personal details – Your name, company, or job title pulled from databases and inserted dynamically to look personal
- Multi-stage trust building – First message is harmless, second builds rapport, third contains the actual attack
What to Do
Before clicking anything, ask:
- Was I expecting this message?
- Is the sender address exactly right?
- Am I being rushed to act?
- Can I verify this through a different channel?
If something feels off:
- Don’t click links or open attachments
- Don’t reply to the message
- Forward it to ForwardToSafety.com for verification
- Report it to your IT team or security contact
- If you already clicked, report it immediately; speed matters
Always:
- Navigate to websites directly instead of clicking email links
- Verify unexpected requests by phone using a number you already have
- Keep macros disabled in Office applications
- Use a password manager so you never type credentials into a phishing page