Spot a phishing email — three quick checks

Modern phishing is grammatically perfect and the sender often looks right. Three habits that catch most of them.

1. Hover before you click. Hover over any link without clicking — the actual URL pops up. If it’s a different domain to what the link text says, it’s phishing.
2. Look at the actual sender address. Not the display name — the bit in angle brackets after it. [email protected] is not Microsoft.
3. Question the urgency. “Your account will be suspended in 24 hours”, “Sign this NOW”, “Send a wire today before the boss notices” — urgency is the manipulation, every time.
4. When in doubt, don’t click. Forward the email to [email protected] — we’ll confirm in minutes.
5. Microsoft Defender will quarantine confirmed phishing automatically — if a real email gets blocked, it’s in your Defender quarantine for 30 days.