Phishing emails are getting better — here's what still gives them away
The obvious spelling mistakes and dodgy logos are mostly gone. The tells that still work are subtler, but they're still there.
Phishing used to be easy to spot: bad spelling, a logo that looked slightly wrong, an email address that obviously wasn't from the real company. A lot of that has quietly improved — well-written phishing emails using a real company's actual branding are now common, sometimes generated or polished with AI tools that iron out the old giveaways.
What's harder to fake is urgency combined with a request that's slightly outside the normal pattern. A genuine invoice from a supplier rarely arrives with "URGENT — pay within the hour or service will be suspended". A real request from a colleague to change bank details for a payment almost never comes only by email, with no other way to confirm it. The pressure and the unusual channel are often bigger tells than anything in the writing itself.
The sender address is still worth a second look, but not just for obvious typos — look for a domain that's close to the real one (an extra letter, a different ending) rather than glaringly wrong. And hovering over a link before clicking, to see where it actually goes, still catches a lot that the email text alone won't reveal.
The single most useful habit, though, isn't a checklist — it's a pause. If an email is asking you to do something unusual, urgent, or involving money or access, verifying it through a second channel (a phone call, a message on a platform you know is genuinely them) costs thirty seconds and catches almost everything a checklist might miss.