Inspecting email
Phishing almost always follows the same pattern. Once you know the patterns and have a fixed routine, you can spot most attempts in a few seconds. In this module we first lay out the patterns and the routine, then you practise with real examples, including one that is actually genuine.
- check_circle The fixed patterns that give phishing away
- check_circle A simple routine: reflect, verify the sender, verify the destination
- check_circle Practise with real examples, including a genuine email
The patterns: what every phishing attempt boils down to
Almost every phishing message combines one of these asks with one or more pressure tactics. When you see this pattern, switch into check mode.
The attacker always wants one of two things:
- “Give me something”: a password, a code, personal data, or a payment.
- “Click on something”: a link or an attachment.
And to push you to act quickly, they add pressure:
- Urgency: “within 24 hours”, “your account will be blocked”.
- Too good to be true: you have won something, a refund is waiting.
- Unexpected: you were not expecting this message.
- Emotion: fear, curiosity, or appeals to authority (“the director is asking…”).
If something sounds too good to be true, it usually is. And a real company or a real bank will never put you under time pressure to confirm your details via a link.
The routine: reflect and verify
Against those patterns, you have one simple habit. Do it in this order, every time.
- 1. Reflect. Pause for a moment. Was I expecting this message? Does the story add up? Do I feel pressure to act quickly? Pressure is itself a signal.
- 2. Verify the sender (the origin). Do not look at the display name, look at the real email domain. “HSBC” tells you nothing;
@hsbc.co.ukor@hsbc-secure.nettells you everything. - 3. Verify the destination (the target). Do not click straight away. Hover over the link or button, or tap and hold on mobile, and read where it really goes.
Go to the official website yourself (type the address or use your bookmark) or call a number you look up yourself. That sidesteps the trap entirely.
The lookalike domain: the trick you have to know
The most important phishing trick is a domain that looks almost right. The display name lies, the domain tells the truth.
service@hsbc.co.uk service@hsbc-secure.net noreply@argos.co.uk noreply@argos-payment.com info@fedex.com info@fedex-delivery.com Look at the part right after the @, or right before the first forward slash of a link. That is where the real domain sits. The question is not whether the display name looks right, but whether that real domain is the official domain of who the sender claims to be. A scammer can freely choose both the name and a lookalike domain.
Some companies use several official domains, for example dhl.com, dhl.co.uk, and dhlexpress.co.uk. A different domain is therefore not automatically fake. In doubt? Look up the official domain via the real website or a search engine, and never use the link from the message.
Scammers play with letters that look similar. The combination “rn” looks like an “m”, a capital “I” looks like a lowercase “l”, and a zero “0” looks like the letter “o”. That turns microsoft.com into an unnoticeable rnicrosoft.com. So read a suspicious domain letter by letter.
A “security alert” from the bank
Apply the routine. Tap on the sender and on the button, then give your verdict.
Dear customer,
We noticed a sign-in from a new device. For your security we have temporarily restricted your access.
Confirm your identity within 24 hours, or your account will be blocked.
Is this message phishing or trustworthy?
- alternate_emailThe real domain is hsbc-secure.net, not hsbc.co.uk. The name "HSBC" tells you nothing.
- link_offThe button goes to hsbc-secure.net, a lookalike domain.
- gpp_maybeA bank will never ask you to "confirm" your identity via an email link.
- scheduleThreatening to block your account "within 24 hours" is pure time pressure.
Not everything is phishing
Important: not every email from a known brand is fake. Apply the same routine and watch for the green flags. Inspect the sender and the button before you judge.
Hello,
Good news! Your order with order number 2026-4471829 is on its way and will arrive tomorrow.
You can track your parcel through your account. We are not asking you to pay or confirm anything.
Is this message phishing or trustworthy?
- check_circleThe real domain is argos.co.uk, and that matches the display name.
- check_circleThe button goes to the real www.argos.co.uk.
- check_circleNo pressure, no request for details or payment, and you were expecting this (you placed an order).
- tips_and_updatesStill in doubt? Then go to argos.co.uk yourself via your bookmark instead of clicking the button.
Outstanding “customs charges”
One more. Inspect first, judge after.
Dear recipient,
Your international shipment is awaiting release. There is £1.49 in customs charges due.
Pay online to avoid delays.
Is this message phishing or trustworthy?
- alternate_emailThe real domain is fedex-delivery.com, not fedex.com.
- link_offThe button points to fedex-delivery.com, and the address also starts with http, not https.
- paymentsPaying a small, unexpected amount is a classic pattern: low enough not to raise suspicion.
A “colleague” asking for your login
Not every phishing attempt uses a brand. Sometimes the message looks like it is from a colleague, often someone you do not speak to every day. Inspect the sender, and pay particular attention to what is being asked.
Hi,
I am locked out of our CRM and have to finish a proposal today for an important client. Can you quickly send me your login (username and password) so I can get in?
I know it is unusual, but it really is urgent. Thanks!
James
Is this message phishing or trustworthy?
- alternate_emailThe real domain is hudsonclarke-uk.com, a lookalike of the real hudsonclarke.co.uk.
- passwordNever share your login or password, not even with a colleague. IT can reset access; a real colleague would not ask this.
- scheduleUrgency and a plausible story ("proposal for a client") put you under pressure.
- verified_userDo not know the colleague well? Verify through another channel: call them, or ask IT.
What you take away from module 2
- bolt Phishing always wants 'give me something' or 'click on something', often with pressure: urgency, too good to be true, unexpected.
- bolt The routine: reflect, verify the sender (origin), and verify the destination (target).
- bolt The real domain sits after the @, or just before the first forward slash of a link. The display name lies.
- bolt Not everything is phishing: watch for the green flags too and verify before you judge.
- bolt When in doubt: never use the buttons in the message, go to the official site yourself or call a number you know.
Module 2 complete 🎉
You now know the patterns and the routine, and you have practised with real emails. In module 3 we apply the same routine to SMS and chat messages, because they have their own traps.
On your way to your “Recognising phishing” certificate
Complete all 5 modules and pass the final exam (at least 70%) to receive a personal certificate of attendance in your name.