Phishing email? What helps

How do you spot a phishing email?

• Urgency and threats: “account locked”, “act now”, a tight deadline. The pressure is meant to switch off your thinking.
• Unexpected: an invoice, parcel notice or password warning you were not expecting at all.
• Too good to be true: an out-of-the-blue prize notification, a voucher or a supposed inheritance. If you never entered, you never won.
• Sender and domain: the address looks almost right, but not quite (extra words, swapped characters, an odd ending).
• Link text does not match the target: the visible text says something different from the real link target. Hover over it without clicking.
• Asking for credentials or payment: reputable providers never ask for passwords by email.

What to do if one arrived

• Do not click. And if you already clicked: do not enter any data there.
• Never log in from the email. Always open the site yourself: type the address into the address bar or use a bookmark, never the link from the email. Links can be manipulated and look deceptively real while still sending you to a fake site. Logging in through a path you already know and calmly checking whether there really is an important problem is completely safe.
• When in doubt, ask directly, through a channel you already know, not via the contact details in the email.
• If you did enter credentials: change the password immediately, set up a second factor or a passkey, and check the account for unfamiliar activity.
• Then delete the email or report it to your provider.

The strongest protection works at sign-in

The tips above help, but they depend on you being alert at the right moment. More reliable is a login that structurally cannot be phished: with a security key or passkey (WebAuthn) your sign-in is bound to the genuine address. On a fake site it simply does not work, no matter how convincing the email was.

How exactly that works, and what matters when choosing a password vault, is here: Phishing-resistant login with a YubiKey.

A short comparison of how a normal login, a password vault and a security key (WebAuthn) hold up against phishing is in that article under Side by side.