The Illusion of Trust
Phishing works by exploiting trust. You receive an email that looks exactly like it came from PayPal, Netflix, or your bank. It has the right logo, the right colors, and a terrifying message: "Your account has been suspended."
Anatomy of a Phishing Email
Scammers rely on you glancing at the display name rather than the actual sender address. A typical attack looks like this:
- Display Name: Apple Security Support
- Actual Sender:
[email protected](Notice the capital 'I' instead of an 'l') - The Hook: A fake invoice for a $499 purchase you didn't make.
- The CTA: A prominent button saying "Cancel Order" or "Report Fraud" that leads to a fake login page.
How to Verify the Sender
Never trust the display name. Always click to reveal the full email address. If you are on a computer, you can inspect the email headers.
Technical Check: SPF, DKIM, and DMARC
Legitimate organizations use email authentication protocols to prove they sent an email. If you view the "Original" or "Raw" source of an email, look for Authentication-Results. If it says spf=fail or dkim=fail, the email is spoofed.
Smishing: Phishing via SMS
Text messages feel more personal and urgent. "USPS: Your package cannot be delivered due to unpaid customs fee of $1.99. Click here: usps-redelivery-info.com".
The Rule: Government agencies (like the IRS or USPS) and major banks will rarely text you a link out of the blue. If in doubt, open a new browser tab, type in the official URL (e.g., usps.com), and track your package there. Never click the link in the text.