How to Smell a Phishing Scam Before It Bites
A client of mine once got an email that looked exactly like it came from her bank. Same logo. Same colors. It said her account was locked and she had 24 hours to verify her information. Her heart jumped. Her finger hovered over the link.
Then she did the smartest thing possible: nothing. She called me instead.
It was a fake, of course. And here’s what I told her, and what I’ll tell you: the scam didn’t almost work because she’s not smart. It almost worked because these things are designed to short-circuit smart people. Phishing — that’s the term for fake messages that try to trick you into handing over passwords, money, or personal info — is a con game, and con games are as old as dirt. Only the envelope has changed.
The Red Flags, in Plain English
After 30+ years of looking at these things, I can tell you they almost always trip over the same wires. I do a lot of grilling, and this part works exactly like the sniff test: if the chicken smells off, it doesn’t go on the grill, no matter how nice the packaging looks. Watch for:
A mismatched sender. The name says “Amazon” but the actual email address is something like `amaz0n-support@randomjunk.biz`. On an iPhone, tap the sender’s name in Mail and the real address pops right up; on a computer (or in Gmail), hover or click the name. That’s like checking the return address on an envelope instead of trusting the letterhead.
Generic greetings. “Dear Customer” from a company that absolutely knows your name.
Links that don’t go where they say. On a computer, hover your mouse over a link (don’t click) and look at the address that pops up in the corner. If the email says “chase.com” but the link says something else, you’ve got your answer.
Weird pressure to pay in strange ways. No legitimate business or government agency takes payment in gift cards. Ever. The IRS does not want Apple gift cards. I promise.
Just slightly “off” writing. Odd phrasing, strange spacing, a logo that looks like it was photocopied twice.
Any one of these is a reason to stop. Two or more? Delete it and go pour yourself a coffee.
Urgency Is the Whole Trick
Here’s the part I really want you to remember. Almost every scam, whether it’s an email, a text, or a phone call, runs on the same fuel: manufactured panic.
“Your account will be closed TODAY.” “Your grandson is in jail and needs bail money NOW.” “Suspicious charge — click here immediately.”
Why? Because a scared, hurried brain doesn’t check sender addresses. Urgency is the con artist’s crowbar. It’s meant to pry you away from the thirty seconds of calm thinking that would sink the whole scheme.
So flip it around and use it as a detector: the more urgent a message feels, the more suspicious you should be. Real companies give you time. Real emergencies don’t arrive by text with a link in them. Good barbecue can’t be rushed, and neither can anything your actual bank needs from you.
Not Sure? Go In Through the Front Door
This is my favorite rule because it works every single time, no technical skill required:
Never respond through the message. Go to the source yourself.
Bank email looks scary? Don’t click the link. Open your browser and type your bank’s website address yourself, or call the number printed on the back of your card. Package delivery text seems odd? Go to the carrier’s website directly and enter your tracking number there.
Think of it like this: if a stranger knocked on your door claiming to be from the gas company, you wouldn’t hand him your checkbook. You’d call the gas company and ask, “Did you send someone?” Same house, same rules — just a digital door.
And if you clicked something you shouldn’t have? Don’t panic, and don’t be embarrassed. It happens to sharp people every day — I’ve seen it hundreds of times. Change the password on the affected account, keep an eye on your statements, and get help sooner rather than later.
A Calm Second Opinion Is Worth a Lot
The single best defense against scams isn’t software. It’s having someone you can ask before you click.
If you’d like that someone to be a patient IT pro who’s seen every flavor of this trick, I’m here. Book a one-on-one session at indigosolutionsllc.com and we’ll tune up your scam radar together — no judgment, no jargon.