A 60-second check for suspicious email

You don't need to analyze headers to catch most phishing. Ask four questions, in order.

1. Was I expecting this?

An invoice you didn't order, a shared file from someone you don't work with, or a password reset you didn't request should all start at "suspicious".

2. Who actually sent it?

Look at the full address, not the display name. IT Support <helpdesk@it-support-portal.co> is not your IT department.

3. Where does the link go?

Hover on a computer, or press and hold on a phone. Read the domain just before the first single slash. If it isn't the site you expected, stop.

4. What is it pushing me to do?

Urgency, secrecy, and unusual payment methods are the pattern. Legitimate requests survive a short delay.

If it fails a check

• Don't click, reply, or open attachments.
• Go to the service through your own bookmark and check there.
• Report it using your mail client's report button, so the sender gets blocked for others too.

If you already clicked and entered a password, change it now from a device you trust, and revoke other active sessions for that account.