How to recognize and avoid phishing scams and social engineering?

Before clicking anything in an email, look at the actual sender address (not just the display name). Phishing emails often show "Apple Support" or "Your Bank" as the name but come from addresses like support@app1e-verify.com. Hover over the sender name to reveal the real email address.

The hallmark of phishing is urgency: "Your account will be suspended in 24 hours," "Unauthorized login detected," or "You owe $500 in unpaid taxes." Legitimate companies rarely demand immediate action via email. When you see urgency, slow down and verify through official channels.

Before clicking any link in an email or text message, hover your mouse over it (or long-press on mobile) to see the actual URL. Phishing links often look legitimate in the text but lead to a completely different website. Check that the domain matches the real company.

Phone-based phishing (vishing) is rising sharply. Scammers impersonate IRS agents, bank fraud departments, tech support, or law enforcement. They use caller ID spoofing to display legitimate-looking numbers. If someone calls claiming urgency, hang up and call the organization directly using their…

Enable the built-in phishing protection in your email provider. Gmail flags suspicious emails with a red warning banner. Outlook has advanced threat protection. For additional protection, browser extensions like Netcraft or Bitdefender TrafficLight warn you before visiting known phishing sites.