← Human Risk Under Pressure: Decisions That Protect You and Your Team
The Psychology of Trust and Pressure
How Attackers Exploit Your Brain's Shortcuts The Urgency Trap — When Speed Overrides Judgment Authority, Familiarity, and the Power of Context
Real-World Attack Scenarios
Email and Messaging Attacks — Spot the Fake Voice and SMS Attacks — The Human Side of Social Engineering Multi-Stage Attacks — When Trust Is Built Over Time
Decisions and Actions That Protect
Pause, Verify, Decide — Your Personal Process What to Do When You're Not Sure Reporting Without Fear — How Early Reporting Changes Outcomes
Real-World Attack Scenarios

Email and Messaging Attacks — Spot the Fake

Learn to spot the subtle signs of phishing and business email compromise in messages you receive every day.

In this lesson, you will learn to:

  • Identify at least three common signs of phishing in email or messaging — such as spoofed sender, urgency cues, or unusual requests — and describe how to verify safely.

Email and Messaging Attacks — Spot the Fake

This lesson walks through real examples of email and messaging attacks. You’ll learn to examine sender addresses, spot urgency cues, recognize common tactics like invoice scams and credential harvesting, and practice safe responses.

The Anatomy of a Phishing Message

Phishing messages are designed to look legitimate, but they almost always contain subtle clues that something is wrong. Here are the most common signs:

1. The sender address doesn’t match the display name. A message might say it’s from your CEO, but the actual email address is a random Gmail or a misspelled domain. Always check the full sender address.

2. Urgency and consequences. The message creates pressure — your account will be closed, you’ll miss a deadline, there’s a security issue. Attackers want you to act before you think.

3. Unusual requests. Someone asking for gift cards, login credentials, or personal information in a way that doesn’t match their role or previous behavior. If it’s unexpected, it’s worth verifying.

4. Language and tone. Slight mistakes in grammar, formatting that’s slightly off, or a tone that doesn’t match the supposed sender. These are often signs of a generic template.

What to do: If you see any of these signs, pause. Don’t click links, don’t reply, and don’t forward without thinking. Verify the sender through a known channel — a phone call you initiate, or a separate email thread you start.

How to Spot a Phishing Message A checklist with four items: Sender Mismatch, Urgency, Unusual Request, and Language and Formatting Errors. Signs of a Phishing Message 1 Sender mismatch Display name does not match the email address 2 Urgency and consequences Act now or something bad will happen 3 Unusual request Gift cards, login credentials, personal information 4 Language and formatting errors Slight mistakes, odd tone, generic template If you see any of these signs, pause and verify
How to Spot a Phishing Message — A visual checklist of common phishing signs: sender mismatch, urgency, unusual requests, and language errors.
What to Do When You Suspect Phishing A flow chart: Pause, Don't Click, Verify Sender using a known contact, Report, and You have protected yourself. What to Do When You Suspect Phishing Pause Don't click links or reply Verify the sender Use a known contact, not the one in the message Report it You have protected yourself
What to Do When You Suspect Phishing — A practical flow chart showing: pause, don't click, verify sender through a known channel, and report.
← Previous: Authority, Familiarity, and the Power of Context Next: Voice and SMS Attacks — The Human Side of Social Engineering →