How to spot a phishing email: seven checks that catch almost all of them

The name in the From line is free text; anyone can type 'Your Bank'. The domain after the @ is what counts, and fakes use lookalikes: an extra letter, a hyphen, a different ending, or a letter from another alphabet.

service@tulpbank.nl           the bank
service@tulpbank-service.com  someone else
service@tulpbankk.nl          someone else

Point at a link (or press and hold on a phone) to see where it really goes. Then read the address from the right: the domain is the last two parts before the first single slash. Everything before that is decoration.

https://tulpbank.nl.secure-login.top/verify
                    ^^^^^^^^^^^^^^^^ the real domain

The text of a link can say anything. Only the address you see on hover counts. A QR code is a link you cannot read, so treat it the same way.

A Reply-To header sends your answer somewhere other than the sender. Calendar tools and helpdesks use it honestly; fraudsters use it to take over a conversation with a free mail address. When you hit reply, look at the To line before you send.

Every mail app can show the original message or its headers. Look for the Authentication-Results line.

Authentication-Results: mx.example.nl;
  spf=fail smtp.mailfrom=vps88213.hostcloud.biz;
  dkim=none;
  dmarc=fail header.from=kijkbox.nl

• dmarc=fail on a well-known brand means the From line is forged.
• dmarc=pass only proves the mail came from the domain shown. If that domain is a lookalike, it proves nothing about the brand.
• A pass from gmail.com or outlook.com means anyone with a free account could have sent it.

The last part of a file name decides what it is. 'invoice.pdf.lnk' is a shortcut that runs a program, not a PDF.

• .htm and .html: a web page, usually a fake login screen.
• .zip with a password: hidden from virus scanners on purpose.
• .docm and .xlsm: documents with macros. Never click 'Enable content'.
• .lnk, .iso, .exe and .js: things that run.

Almost every phish adds a reason to hurry or to stay quiet: deleted today, locked in 24 hours, keep it between us, don't call the office. Real companies give you weeks and don't mind you checking.

When in doubt, use nothing from the mail. Open the app, type the site's address yourself, or call a number you already had. A supplier's new bank account, gift cards for the boss, a payment you never made: always confirm by phone first.

Spot the Phish puts one made-up mail in front of you every day to practise these checks, with every clue explained afterwards.