Phishing emails used to be easy to spot. A misspelled subject line, a logo that looked slightly off, a sender you'd never heard of. Those days are gone. The messages landing in inboxes now are polished, context-aware, and often indistinguishable from legitimate mail. Even people who think they know the signs are clicking. The red flags have changed, and some of the most dangerous ones are hiding in places you might not think to check. In 2026, attackers use automation to scrape your job title, your recent purchases, and your colleagues' names, then craft a message that feels like it was written just for you. The result is a phishing landscape where experience alone is not enough. You need a repeatable verification habit.

The 10 Red Flags

Here are the ten cues that should stop you before you click, reply, or pay. Any one of these is worth a pause. Two or more together? Stop and verify.

1. Display-name spoofing. The sender name says "PayPal" or "Your CEO," but the actual email address is a giveaway. Hover or tap to see the full address.
2. Reply-to mismatch. The reply-to address differs from the sender address. Attackers want your reply to go to them, not the real organization.
3. QR codes in emails. A QR code might lead to a fake login page. If you didn't request it, don't scan it.
4. Urgent payment requests. "Wire the funds today" or "Update your payment details immediately" are pressure tactics. Verify through a second channel.
5. Subtle domain variations. Look for transposed letters, added hyphens, or different top-level domains (e.g., .co instead of .com).
6. Unexpected attachments. HTML attachments, password-protected ZIPs, or documents that ask you to enable macros are common malware delivery methods.
7. Thread hijacking. A reply to an email thread you recognize, but the sender's address has changed or the content doesn't quite fit the conversation.
8. MFA fatigue triggers. An email that prompts you to approve a login you didn't initiate, or bombards you with notifications until you click "approve."
9. Generic or oddly personal greetings. "Dear Customer" from a company that knows your name, or a colleague writing in an unusually formal tone.
10. Links that don't match the text. Hover over links to see the real destination. A link that says "company.com/portal" but goes to "company.secure-login.xyz" is a trap.

The list is a start, but the real danger is in the details. Let's look at the three that catch the most people, then cover a few newer tricks that even seasoned users often miss.

Display-Name Spoofing: The Name Is Not the Address

Your email client shows the display name in bold. Attackers set it to "Microsoft Support," "Your Bank," or "Jane Doe, CFO." The actual address might be "[email protected]" or "[email protected]." Many people check the name and stop. On mobile, the address is often hidden, so tap or hover to expand the sender details. If the name is a known contact, call them at a number you already have. Don't reply to the email. A quick verification call takes thirty seconds and can save you from a costly mistake.

Consider this real-world pattern: an employee receives an email from "IT Helpdesk" asking them to confirm their password before a scheduled system upgrade. The display name looks right, the logo is correct, and the message even references the company's actual VPN. But the address is "[email protected]" instead of "[email protected]." The employee replies, and the attacker now has a working password and a foothold. The lesson: the display name is a label, not an identity. Treat it like a business card someone printed at home.

Quishing: When a QR Code Is a Trap

QR codes are convenient, which is exactly why attackers use them. A QR code in an email bypasses your computer's link scanners. You scan it with your phone, which may not have the same protection. The code leads to a fake login page that captures your credentials or downloads malware. Red flags include an unsolicited QR code, a QR code that asks for your MFA code, or a QR code in an email that could have used a simple link. If you must scan, check the URL preview in your camera app before opening. Better yet, use a scanner that shows the full URL. If it's from a known sender, verify through another channel.

Attackers also use QR codes in physical spaces—parking meters, restaurant tables, flyers—but email-based quishing is growing because it blends into routine workflows. A message from "HR" might say, "Scan this code to review your new benefits." The code opens a Microsoft 365 login page that looks perfect. You enter your credentials and approve the MFA prompt. The attacker now has access. If the email includes a QR code, ask yourself: why couldn't this be a normal link? If there's no good answer, don't scan.

Urgent Payment Requests: The Pressure to Act

Messages that demand immediate payment or a change to payment details are designed to short-circuit your skepticism. The request might come from a compromised account or a display-name spoof. Common phrases: "I need you to process this wire today," "Update your direct deposit information immediately," or "This is confidential—don't discuss it with anyone." The urgency is the red flag. Never act on payment changes via email alone. Call the person at a known number. If it's a vendor, call your known contact. If it's your CEO, call their office. A second channel is your best defense. If you're unsure, involve your finance or security team before acting.

Example: "Hi, I'm in a board meeting and can't talk. I need you to send a wire to a new vendor today. I'll explain later. This is sensitive—please keep it between us."

Why it works: It combines authority, urgency, and secrecy. Those three ingredients are designed to make you skip verification. A real executive will understand if you confirm through a known channel.

Other Red Flags That Slip Through

Beyond the top ten, a few quieter signals often go unnoticed. Inconsistent formatting is one: a legitimate company email usually follows a template, but a phishing message may mix fonts, spacing, or button styles. Unexpected calendar invites with vague titles like "Quick sync" can carry malicious links or trick you into sharing meeting details. Password-expiry warnings that link to a fake reset page are still effective, especially when they arrive during a busy week. Unusual sender behavior—a colleague who suddenly writes in broken English, or a vendor who changes bank details without a phone call—deserves scrutiny. Tracking pixels and remote images can also confirm your email is active, so if a message feels off, consider blocking remote content until you verify. None of these alone proves an attack, but they add up. The more small inconsistencies you see, the more reason you have to slow down.

A Simple Verification Habit That Beats Most Attacks

You don't need to become a security analyst. You need a habit that is easy to repeat. Try the three-step pause before you act on any email that asks for credentials, payment, or a file download.

1. Stop. Do not click, reply, scan, or open the attachment. Close the message if you need to remove the pressure.
2. Check the address. Expand the sender details and read the full email address, not just the display name. Look for mismatches, odd domains, and reply-to differences.
3. Verify through a second channel. Call the person or company using a number you already have—not one from the email. Or open a new browser tab and type the known website address yourself.

This habit works because it removes the attacker's biggest advantage: the moment of automatic response. Most phishing succeeds when you act before you think. A thirty-second pause is often enough to spot the trick. If you're in a hurry, that's exactly when you should be most suspicious. Urgency is the attacker's tool, not a reason to skip verification.

If You Clicked: The First 10 Minutes Matter

Even careful people make mistakes. If you clicked a link, entered credentials, or opened an attachment, act quickly and don't hide it. Embarrassment is not a security strategy.

1. Disconnect if malware is suspected. If you opened an attachment and your device behaves strangely, disconnect from Wi-Fi or unplug the network cable. This can limit data exfiltration.
2. Change the compromised password. Do this from a different, trusted device. If you reused that password anywhere else, change it there too.
3. Report it. Tell your IT or security team immediately. They can check for suspicious logins, reset sessions, and warn others.
4. Watch for follow-up attacks. Attackers often use the first breach to send more convincing phishing from your real account. Alert your contacts if necessary.
5. Enable MFA everywhere. If you haven't already, turn on multi-factor authentication for email, banking, and work accounts. Use an authenticator app rather than SMS when possible.

The faster you report, the smaller the damage. A single click is not the end of the world, but silence can turn a small incident into a major breach

Photo: Talenvni / Pixabay