The habit that stops most attacks
Hovering over a link before clicking remains the single most effective check. The displayed text in an email or on a page can say anything; the underlying destination reveals the truth. In every major email client and browser, resting the cursor on a link surfaces the actual URL in a tooltip or status bar. Make this automatic. If the destination domain does not match the purported sender, do not click.
Domain inspection: spelling tricks and subdomain traps
Attackers register domains that visually mimic legitimate ones. Substituting the numeral 1 for the letter l, or 0 for O, is the classic example. More sophisticated variants place the target brand in a subdomain: security.chase.com.attacker.com. The registered domain is the rightmost segment before the top-level domain. Read from right to left. A legitimate bank email will never send you to a domain the bank does not own.
HTTPS is necessary but not sufficient
A padlock and https:// mean the connection is encrypted. They do not mean the site is legitimate. Certificate authorities issue TLS certificates to anyone who controls a domain. A phishing site can present a valid certificate for its own deceptive domain. Always verify the domain name in the address bar matches the organization you intend to visit. If the certificate details show a mismatch or an untrusted issuer, treat the site as hostile.
Shortened links: expand before you trust
URL shorteners hide the destination. Bit.ly links accept a trailing plus sign (bit.ly/abc123+) to show a preview page. Services such as checkshorturl.com or urlex.org reveal the final target without visiting it. Paste the shortened link into one of these tools before clicking. If the expanded destination is unfamiliar or unrelated to the message context, discard the message.
Sender headers: the forensic view
The friendly "from" line is trivial to forge. Open the full message headers (often labeled "Show original" or "View source") and examine the Received chain, SPF, DKIM, and DMARC results. A message that fails authentication checks or originates from an unrelated mail server is almost certainly spoofed. This check takes thirty seconds and eliminates a large fraction of convincing impostors.
Language, urgency, and the request for credentials
Phishing messages rely on pressure. Threats of account closure, legal action, or missed deliveries create artificial deadlines. Legitimate organizations rarely demand immediate credential entry via email. Impersonal salutations ("Dear Customer," "Hello") and mismatched sender addresses are hallmarks of bulk phishing. Spear-phishing campaigns targeting your firm may use your name and reference specific matters; the urgency tactic remains the same. Verify through a known channel: call the sender or visit the organization's site by typing the address yourself.
Two-factor authentication as a backstop
If credentials are stolen, multi-factor authentication (MFA) prevents account takeover. Prefer hardware tokens or authenticator apps over SMS codes, which are vulnerable to SIM-swapping. Enforce MFA on every system that touches client data, email, or financial accounts. This is not optional for regulated practices.
What to do after a click
If you entered credentials on a suspicious site, act immediately. Change the password on the real service. Enable or re-enroll MFA. Notify your IT provider and the legitimate organization's security team. Forward the phishing message to the Anti-Phishing Working Group (reportphishing@apwg.org) and to the impersonated organization's abuse address. If client data may have been exposed, follow your breach-notification obligations without delay.
Reporting ecosystem
PhishTank and the APWG maintain community-verified blocklists that feed browser warnings and email filters. Submitting suspicious URLs improves protection for everyone. Many endpoint protection platforms also accept submissions. Make reporting a routine step in your incident response playbook.
Comparison: consumer habits vs. professional obligations
A personal email user can delete a suspicious message and move on. A law firm or healthcare practice that clicks a phishing link may trigger a reportable breach, regulatory inquiry, and loss of client trust. The technical checks are identical; the consequence gradient is not. Build the hover habit into onboarding, reinforce it in quarterly phishing simulations, and treat every reported message as a training datum, not a failure.