Phishing drove around 36% of confirmed breaches in Verizon's most recent breach report. It stays at the top because it does not attack your software — it attacks the fact that you are busy.
Forget spelling mistakes
The advice to look for bad grammar is a decade out of date. Modern phishing is well written, correctly branded, and often a real reply inside a real thread the attacker has read. Look at these instead:
The four reliable tells
- Urgency with a deadline. Your account closes today, the invoice is overdue, the payroll change must go in before five. Real organisations rarely give you hours. Pressure exists to stop you checking.
- The link does not go where the text says. Hover over it without clicking — on a phone, press and hold. Read the domain immediately before the first single slash. microsoft.com.login-verify.net is not Microsoft; it is login-verify.net.
- It asks you to break a normal process. Pay to new bank details, buy gift cards, send a document outside the usual system, tell nobody because it is confidential. Any request to bypass the usual way of doing things is the request itself.
- The reply-to address differs from the sender. Expand the header. A display name is free to set to anything; the actual address is harder to fake.
When it looks like someone you know
The most effective phishing comes from a colleague's genuinely compromised account, so every technical signal checks out. The defence is not technical — it is a habit. Any request involving money or credentials gets verified on a different channel. Phone the person on the number you already have. Not the number in the email.
If you clicked
- You only opened it: generally fine. Simply reading a message rarely does anything.
- You entered a password: change it now from another device, and everywhere you reused it. Turn on two-factor authentication.
- You opened an attachment: disconnect from the network and get the machine checked. Do not just delete the file.
- It was a work account: tell whoever handles IT immediately. Speed matters far more than embarrassment, and everyone has clicked something at some point.
If any of this is beyond where you want to go on your own, a Koadi technician can take it from here — remotely anywhere in the US, or on-site in New Jersey, New York and Pennsylvania. Describe the problem in your own words and someone who does this every day will pick it up.