Phishing prevention best practices

Imagine you are sitting at home when a courier knocks on your door. He is wearing a uniform that looks vaguely familiar, carries an official-looking clipboard, and tells you there is an urgent security issue with your bank account. To fix it, he asks you to hand over your house keys and write down your PIN.

Would you do it? Of course not. You would close the door and call your bank directly.

In the physical world, we are naturally skeptical of strangers making strange, urgent requests. But in the digital world, cybercriminals pull this exact stunt every day. This trick is called phishing, and it is one of the most common ways attackers break into personal accounts and corporate networks.

Instead of knocking on your door, they drop an email, text message, or DM into your inbox. And instead of picking a digital lock, they simply trick you into handing over the keys.

The anatomy of the bait

The word “phishing” is spelled with a “ph” as a nod to early hacking history, but the concept is exactly like real-world fishing. The attacker throws enticing bait into the digital ocean, hoping a busy or distracted person will bite.

Phishing works because it targets human psychology, not computer code. Typically, the bait relies on three triggers:

• Artificial urgency. “Your account will be suspended in 24 hours!” Panic overrides logic. When we are scared of losing access, we click first and ask questions later.
• Authority. Criminals impersonate people we naturally trust, like your company’s CEO, the IT department, your bank, or a government agency.
• Too good to be true. “You have an unclaimed package waiting” or “Click here for a surprise bonus.” They play on curiosity and the desire for a quick win.

Spotting the red flags

You don’t need a degree in cybersecurity to spot a phishing attempt. Most leave distinct clues. When an unexpected message arrives, look for these warning signs:

• A close-but-wrong sender. An email might look like it’s from support@netflix.com, but the actual sender reads support@netfIix-security-update.com (with a capital I instead of an l) or hides an extra character.
• A generic greeting. A service you pay for will usually address you by name about anything critical. Beware of “Dear Customer” or “Valued Employee.”
• The panic button. Legitimate companies rarely threaten to delete your account within minutes if you don’t click a specific link.
• A hidden destination. Before clicking a link, hover over it (or long-press on a phone) to see the real web address. If the text says “Log in to Amazon” but the link points to a random string or a strange site, don’t click.

Your step-by-step defence

If a message feels off, follow these rules to protect yourself and your workplace:

1. Stop and breathe. Never let a message rush you. Take five seconds to look at it objectively. Attackers rely on you acting while emotional or distracted.
2. Verify through a trusted channel. If an email claims your bank account is locked, don’t use its link. Open a new browser window, type your bank’s address yourself, and log in. If there’s a real issue, you’ll see it there.
3. Report it. At work, use your “Report phishing” button or forward the message to your security team. Flagging it helps block the attacker from reaching your colleagues.
4. Turn on multi-factor authentication (MFA). Even if you’re tricked into giving away a password, MFA stops most attackers from logging in. Prefer an authenticator app or a passkey over SMS codes: some phishing kits now relay one-time codes in real time.

Final thoughts: don’t take the bait

Phishing succeeds because it’s simple, cheap, and effective against busy people. But the attacker only wins if you interact. Pause, verify the source independently, and keep an eye out for red flags, and their fishing trip ends with an empty hook.