Phishing Has Gotten a Lot More Convincing
The stereotype of a phishing email — riddled with typos, an obviously fake sender address, a wildly implausible story about a foreign prince — is largely outdated, even though it still shapes how a lot of people imagine the threat. Modern phishing attempts have gotten considerably more polished, and the ones causing real damage today often look nearly indistinguishable from a legitimate message at first glance.
A convincing phishing email today typically mimics a real company’s branding closely, uses a sender address that looks correct at a glance, and creates a plausible reason for urgency — a suspicious login attempt, a payment that failed, a package that couldn’t be delivered. The urgency is deliberate, designed to get you clicking before the analytical part of your brain has time to slow down and scrutinize the details.
One of the more reliable ways to spot these attempts, even the well-crafted ones, is checking where a link actually leads before clicking it, rather than trusting the visible text of the link itself. Hovering over a link on a desktop, or long-pressing on mobile, usually reveals the actual destination URL, and a mismatch between what the link claims to be and where it actually points is one of the clearest red flags available, regardless of how polished the rest of the email looks.
Another useful habit is treating urgency itself as a warning sign rather than a reason to act quickly. Legitimate companies rarely demand immediate action through email alone, especially for anything involving money, passwords, or account access. If an email is pushing hard for you to act within minutes or hours, that pressure is often the tell, not the content of the message itself.
The Signs Worth Watching For
It’s also worth being suspicious of unexpected attachments, even ones that appear to come from someone you know. Compromised email accounts are frequently used to send malicious attachments to the victim’s own contact list, since a message from a familiar name naturally lowers everyone’s guard. If an attachment feels unexpected or out of character, it’s worth confirming through a separate channel — a text message or phone call — before opening it.
When in doubt, the safest move is going directly to the company’s website by typing the address yourself, rather than clicking any link in the email at all, and checking your account status from there. It’s a small extra step, but it sidesteps the entire trap regardless of how convincing the original message managed to look.
Beyond email, phishing attempts have expanded significantly into text messages and messaging apps, a category sometimes called smishing, and these often feel even more convincing than email precisely because people have historically trusted text messages more, assuming incorrectly that this channel is somehow more secure or harder to fake than email. A text claiming to be from your bank or a delivery service, complete with a link to ‘verify’ something, follows exactly the same manipulative pattern as email phishing, just delivered through a channel where people’s guard tends to be lower.
Voice-based scams have also grown more sophisticated, sometimes using AI-generated voice cloning to impersonate a family member or colleague convincingly enough to fool even a cautious listener over a phone call. While this remains less common than email or text-based phishing for now, it’s worth having a simple, agreed-upon verification habit with close family — a code word or a policy of calling back on a known number before acting on any urgent request involving money, regardless of how convincing the voice on the other end sounds.
Staying Safe Without Overthinking Every Email
Businesses face a particular version of this threat known as business email compromise, where attackers specifically target employees with access to company finances, often after quietly studying the organization’s structure and communication style well enough to convincingly impersonate an executive requesting an urgent wire transfer. Organizations that build in a mandatory secondary verification step for any financial request — even one that appears to come from a senior leader — close off one of the more financially damaging phishing variants that exists.
Reporting suspicious messages, rather than simply deleting them, is worth doing more consistently than most people currently do. Most email providers and many companies have a simple built-in reporting mechanism specifically for this, and reported phishing attempts help providers improve their filtering for everyone else, not just protect your own inbox. It’s a small extra step, but at scale, this kind of collective reporting genuinely does make these campaigns somewhat less effective over time as filtering systems improve in response.
The common thread across every version of this threat, whether it arrives by email, text, or phone call, is the deliberate manufacturing of urgency to short-circuit careful thinking. Building the habit of slowing down, verifying independently, and treating unexpected urgency itself as a red flag remains the single most effective defense available, regardless of how convincingly any individual attempt happens to be crafted.
It’s also worth teaching this same awareness to less tech-savvy family members, particularly older relatives who are often specifically targeted by these scams precisely because they’re perceived as less likely to verify a suspicious request before acting on it. A short, calm conversation about what these attempts typically look like can meaningfully reduce their risk, and it’s a genuinely worthwhile use of a few minutes with someone you care about.
Teaching this same awareness to less tech-savvy family members, particularly those more likely to be targeted, is a short conversation that can meaningfully reduce their risk too.