Recognise Phishing Even When the Message Has Perfect Grammar
A phishing message can be fluent, well-designed and apparently relevant to your work. Do not use spelling mistakes as your main test. Focus on what the message asks you to do, how you can verify the request independently and whether it tries to create urgency around credentials or payments.
Why it matters
Branding and familiar names are easy to imitate. A genuine-looking email becomes less persuasive when you check the claim through a known app, saved address or independently obtained contact method.
A practical workflow
- Pause before opening an unexpected attachment or following a link that demands immediate account action.
- Inspect the actual sender and destination, while remembering that an apparently familiar account can also be compromised.
- Open the service through your usual trusted route and check whether the claimed issue appears there.
- Report suspicious messages through the appropriate service or organisation process, and follow official recovery guidance if you responded.
An example
An email might claim your cloud account will be suspended unless you verify billing. Instead of using its link, open the provider through your saved address and check account notices. If uncertainty remains, contact support using details obtained from the genuine site.
A mistake to avoid
Do not reply to the suspicious message to ask whether it is real. Also avoid uploading private messages and attachments to random checking sites. Verification should not create another unnecessary disclosure.
Try it and check the result
Review a few harmless sample messages and explain the independent route you would use to verify each request. The habit to build is verification through a known channel, rather than confidence based on appearance.
Reference and further reading
FTC: recognising and avoiding phishing scams.
The workflows and examples in this guide are illustrative. Product controls and availability can change; check the linked official guidance for your setup.
Continue with Enable Two-Factor Authentication and Plan for Recovery or explore all blog topics.