A phishing email only has to work once. The click, the reply, the quick judgment that the message came from a name you recognize — those decisions take seconds, and they are where most of the damage happens. The reassuring part is that phishing defense is less about technical skill than about habits. Below are the mistakes that cause the most trouble, and what to do instead.

1. Clicking the Link Just to See Whether It's Real

Curiosity is exactly what the sender is counting on. The link is usually the whole point of the message: it either opens a fake login page or quietly confirms that your address is live and monitored. You do not need to enter a password for harm to follow.

If you want to know where a link leads, hover over it on a desktop or long-press it on a phone. The destination that appears rarely matches the text you see. Watch for brand names buried in the middle of a domain, as in login-secure.example.com rather than the company's own domain, and for small substitutions such as a lowercase rn standing in for an m.

The safer alternative: never use an emailed link to reach a service. Open your browser, type the address or use your own bookmark, and check your account there. If there is a real problem, it will be waiting for you.

2. Replying, Forwarding, or Hitting Unsubscribe

Every reply is a receipt. It tells the sender the address is real, that a person reads the inbox, and that the message beat the spam filter. Many attacks are deliberately conversational: the first email asks a harmless question, the second asks for a payment change, gift card codes, or a password reset.

Unsubscribe links in suspicious messages work the same way as replies, and forwarding is its own problem. Sending the email along to a colleague spreads the risk and can strip out the context your security team needs. If you must share it, use your company's report button, which sends the full message headers to the people who can block it.

3. Trusting the Display Name Instead of the Address

The display name is free text. Anyone can appear as "IT Helpdesk," "Microsoft 365," or your manager's name. Before you judge a message, look at the full email address, especially the part after the @. Then check the reply-to field: if replies route somewhere different from the sender's domain, treat that as a strong warning sign.

One more detail that catches experienced people: a message can come from a genuine, familiar address and still be phishing. If a colleague's account was compromised, the mail is real from their side, which is why requests for payments, credentials, or one-time codes deserve a second channel of verification regardless of who appears to be writing. Short, unusual messages from a known contact — "Are you at your desk?" — are a common opening move.

4. Letting Urgency Set the Pace

Phishing depends on speed. Deadlines, locked accounts, expiring invoices, and warnings about unauthorized access all push you toward acting before thinking. The pressure is the trick; the request underneath rarely survives a pause.

Slow down and verify through a channel you chose yourself. Call the number you already have on file, not the one in the email. Start a new message to the person instead of replying. Walk down the hall if it is a colleague. It takes two minutes, and nothing important has ever been lost by confirming a payment request.

Some requests should be treated as suspicious on sight, no matter how calm the message sounds:

• Anyone asking for your password or a one-time verification code — help desks never need these.
• Requests to change bank details, payment instructions, or payroll information.
• Gift card codes, crypto transfers, or "urgent" purchases.
• Instructions to keep the message confidential or to skip the usual approval process.

5. Opening Attachments, Enabling Content, or Scanning Unknown QR Codes

Attachments are a delivery method, not just a document. Beware of files that only make sense as a trap: HTML files that open a fake login page, zipped archives that need a password, or Office documents that ask you to Enable Content or Enable Editing before you can read them. A legitimate invoice or policy document does not need macros to be displayed.

QR codes in emails deserve the same caution as links, because the destination is invisible until your phone opens it. If a message pushes you toward scanning a code to "re-verify" or "restore" an account, close it and reach the service the usual way.

6. Deleting the Message Instead of Reporting It

Deleting feels tidy and cleans nothing up. Your report is often the first signal that a campaign is running, and it lets the security team block the sender and warn everyone else before someone clicks. Most mail clients and security tools have a one-click report button; learn where yours is.

The same instinct applies after a mistake. If you clicked or replied, say so immediately. Reporting early is not an admission of failure, it is the cheapest possible fix, and it lets someone reset credentials or watch for follow-up activity while there is still time. Embarrassment is what turns a small incident into a long one.

If You Already Clicked: A Short Recovery Plan

Act quickly and in this order:

1. If you entered a password, change it now from a different device, then change it anywhere you reused the same password.
2. Turn on multi-factor authentication if it is not already active, and review your active sessions and devices for anything unfamiliar.
3. If you opened an attachment or enabled content, disconnect from the network, run a security scan, and contact your IT or security team.
4. If money moved or gift card codes were shared, call your bank or finance department right away — speed matters more than anything else here.
5. Report the message, then stay alert for follow-up emails that reference the first one and sound more convincing.

For anything involving funds, contracts, or identity documents, involve your bank, your employer's security team, or a qualified professional rather than working it out alone.

Most of this comes down to one habit: treat every unexpected message as unverified until you have confirmed it somewhere else. You do not need to be suspicious of everything. You just need to be consistent about the few minutes it takes to check.

Photo: geralt / Pixabay