The phishing emails that reach your inbox in 2026 no longer look like phishing. Grammar is clean, branding is copied accurately, and the sender name often matches a service you actually use. Spam filters catch the crude attempts and leave the polished ones, which means the last line of defence is a reader who checks before clicking.
The Urgency Trick Still Works
Almost every successful phish creates a deadline. An account will close, a parcel will return, a payment will fail, or a document needs a signature today. Urgency exists to stop you checking. The moment a message demands immediate action, treat that demand as a signal, not as a fact.
Real services rarely threaten account closure by email with a same-day deadline. They send repeated notices, and they show the same warning inside your account dashboard. If a message claims urgency, open the service’s app or type its address yourself and check there. A warning that exists only inside one email is not a warning from the service.
Lookalike Domains Are the Core Skill
The sender address is the one field a phish cannot fully fake, so it is where most attacks give themselves away. Read the domain — the part after the @ — character by character. Common tricks include:
- A misspelled brand: paypa1.com, micros0ft.com, arnazon.com
- A brand as a subdomain: apple.support-update.com, where the real domain is support-update.com
- An extra word that sounds official: paypal-secure.net, google-verify.org
- A lookalike suffix: a .com replaced by .co, .net, or a country code
Display names mean nothing. Any sender can set a display name of “PayPal” or “Your Bank” while the underlying address belongs to a stranger. Mail apps show the display name by default, so expand the sender details before trusting a message that asks for credentials or payment.
Links, Attachments, and QR Codes
Hover over a link before clicking, and read the destination it shows. A button labelled “Verify your account” that leads to an unrelated domain is a phish, regardless of how polished the email looks. On a phone, long-press the link to preview the address. If the preview and the claimed destination disagree, stop.
Attachments deserve the same suspicion. A phish attachment may be a document, a zip file, or an HTML file that opens a fake login page in your browser. Legitimate services rarely send unexpected attachments, and they never send login pages as attachments. If an attachment arrives unannounced, confirm with the sender through a separate channel before opening it.
QR codes are the newest blind spot. A QR code in an email hides its destination completely, which is exactly why attackers use it: no link text to inspect, no domain to read. Do not scan a QR code from an email you did not expect. If a service genuinely needs you to scan something, it will show the same code inside your account after you sign in normally.
AI-Written Phish Raised the Bar
Generative writing tools removed the old tells. Spelling errors, awkward phrasing, and odd formatting used to mark a phish; now a phish can read better than a real support email. Some attacks also personalize: they reference a real order, a real colleague, or a real service you use, using details from earlier breaches.
Personalization is not proof of legitimacy. Breach data supplies names, order numbers, and employer details to anyone willing to buy it. Judge the message by what it asks you to do, not by what it knows about you. A request for a password, a payment, a code from your authenticator app, or a remote-access session is a hard stop, no matter how personal the message feels.
The Two-Minute Verification Routine
When a message asks for anything sensitive, run this check before acting:
- Read the sender domain in full, not just the display name
- Preview every link destination; never trust button text
- Open the service yourself by typing its address or using its app
- Never enter credentials from a link inside an unexpected email
- Report the message as phishing in your mail app, then delete it
Reporting matters beyond your own inbox. Mail providers use reports to block the same attack for other users, and a reported sender domain gets flagged faster than one nobody flagged.
If You Already Clicked
A click is not the end of the story, and panic is the wrong response. What matters is what happened after the click. If you entered credentials on a fake page, change that password immediately, starting with the real service, and change it on any other service where you reused it. Then switch on two-factor authentication if it was not already on, and review the account’s recent sessions for anything unfamiliar.
If you entered payment details, contact your card issuer and describe the disclosure. A replacement card is a minor inconvenience compared with fraudulent charges discovered weeks later. If you downloaded and opened an attachment, run a malware scan and watch for unusual account activity over the following days.
If you only clicked a link and entered nothing, the risk is lower but not zero. The visit may still have logged your address as active, which can increase future phishing volume. Mark the message as phishing, and stay alert for follow-up attempts that reference the same brand. Report the attack through your mail app’s phishing report, and consider telling the impersonated service through its official abuse channel.
Final Verdict
Spam filters now handle the obvious phish and leave the convincing ones, so the check has moved to you. Read the domain, preview the link, and verify through the service’s own app before acting on any urgent request. A message that survives those three checks is worth trusting. One that fails any of them belongs in the phishing report folder, unanswered.
