Spot phishing by checking the one thing an attacker cannot fake: the registrable domain of the link, read from the right-hand end of the hostname. Everything else in a message, from the sender's display name to the logo and the padlock, can be copied. Combine that check with the tone of the message, urgent and demanding action through a link, and you will catch nearly every attempt.
Why phishing works
A phishing message succeeds when it looks right at a glance and pushes you to act before a second glance. The technical tricks exist to survive the first glance; the psychological tricks exist to prevent the second. Defending against it therefore has two halves: a habit of looking at the one thing that cannot be faked, and a habit of slowing down when a message is trying to speed you up. The password guide and two-factor guide explain what a phishing page is after and which protections survive it; this guide is about not reaching the page.
Read the URL from the right
A hostname is read right to left. The last label is the top-level domain, and the label before the public suffix is the one somebody registered and controls. Everything to the left of that is a subdomain the registrant can name however they like. The registrant of the domain is who you are actually talking to, no matter what appears elsewhere in the address. Consider:
https://www.paypal.com/signin registrable domain: paypal.com
https://paypal.com.account-verify.example/signin registrable domain: account-verify.example
https://secure-paypal.com/signin registrable domain: secure-paypal.com
https://www.paypa1.com/signin registrable domain: paypa1.com
https://198.51.100.7/paypal/signin no domain at all, a bare IP address
https://example-shortener.example/x7Kq9 destination unknown until followedOnly the first is PayPal. The second puts the brand in a subdomain of a domain the attacker registered; the third and fourth are lookalike registrations; the fifth has no domain, which no legitimate consumer service uses for a login page; the sixth hides the destination behind a shortener. On a phone, where the address bar truncates and shows only part of the hostname, the subdomain trick is especially effective because the visible portion reads correctly. Tap the address bar to see the whole thing, or better, do not use the link at all.
Our phishing URL checker applies these tests mechanically: it flags a brand in the subdomain, a lookalike domain, an IP address as host, a shortener, and credentials embedded in the URL, which is an old trick for making https://[email protected] look like a PayPal address.
Lookalike characters and punycode
Lookalikes come in two kinds. The first is within the Latin alphabet: rn for m, lowercase l for uppercase I, 0 for o, a dropped or doubled letter, or a plausible extra word such as -secure or -login. The second is homograph attacks using other scripts. Internationalised domain names allow Unicode in hostnames, encoded on the wire with the IDNA punycode scheme, which turns a non-ASCII label into an ASCII label starting with xn--. Cyrillic has letters visually identical to Latin a, e, o, p, c and others, so a domain can be registered that renders as a familiar brand name while being entirely different characters:
display form: apple.com (every letter Cyrillic)
wire form: xn--80ak6aa92e.comThat example was registered in 2017 as a demonstration and led browsers to tighten their display rules: Chrome, Firefox and Safari now show the xn-- form when a label mixes scripts or looks confusable, so the address bar usually reveals the trick. The message body does not, and neither does a hover tooltip in many mail clients. The punycode check in our URL checker decodes any xn-- label and shows what it would display as. A useful rule: a consumer brand with an English name has no reason to be at an xn-- domain.
What the padlock does and does not prove
An HTTPS connection with a valid certificate proves that you are talking to a server that controls the domain in the address bar and that nobody on the path can read the traffic. It proves nothing about who registered the domain. Certificates are free and automated, and phishing sites are overwhelmingly served over HTTPS today. Treat the padlock as a necessary condition, since its absence on a login page is disqualifying, and never as evidence of legitimacy. The certificate errors guide explains the warnings that do indicate a problem, and a missing HTTPS finding is one of the few that can rule a page out outright.
Checking the sender
The display name on an email is free text; PayPal Support <[email protected]> is trivial to send. Look at the address, and specifically at the domain after the @, applying the same right-to-left reading. Then look for a mismatch between From and Reply-To, which routes your answer to a different mailbox. Whether an attacker can send mail that genuinely shows a brand's own domain depends on whether that brand has deployed SPF, DKIM and DMARC; with a DMARC reject policy in place, spoofed mail from the exact domain is discarded before you see it, which is why attackers fall back to lookalikes. The email authentication guide explains the records, and you can check any domain's posture with an SPF and DMARC lookup.
Text messages and messaging apps show no domain at all, only a number or a name, and links in them are shortened or bare. Treat every link in an SMS as unverified, and when the message claims to be from your bank or a delivery company, use the app or the website you already have.
The message itself
The technical checks confirm a suspicion; the tone raises it. Recognise the patterns:
- Urgency: an account will be closed, a parcel returned, a payment missed, unless you act within hours.
- Consequence and authority: a tax office, a court, the police, your employer's chief executive.
- Secrecy: do not discuss this with colleagues, handle it personally.
- An unusual channel or request: a supplier changing bank details by email, a manager asking for gift cards, an IT desk asking for a code.
- A link or attachment as the only path: the message insists you use its link rather than the site you know.
Attachments deserve their own suspicion. An invoice as a macro-enabled document, an HTML file that opens a local login form, a PDF with a button that goes to a credential page, or a ZIP containing a shortcut file are all standard delivery methods. The macro malware guide covers the first; any attachment you did not expect can go through a file scanner before it is opened.
| Signal | Fakeable? | Weight |
|---|---|---|
| Registrable domain of the link | No | Decisive |
| Sender address domain (with DMARC enforced) | No | Strong |
| Sender display name | Yes | None |
| Logo, layout, wording | Yes | None |
| HTTPS padlock | Not fakeable, but proves little | Absence is disqualifying; presence is neutral |
| Urgency and pressure | N/A | Strong suspicion |
Phishing beyond email
The same tricks arrive through channels where the URL is harder to inspect, and each deserves its own habit.
QR codes hide the destination entirely until scanned; a sticker over a genuine code on a parking meter or a QR code in a "your parcel is held" letter leads to a payment page on a domain you never saw. Treat a scanned URL exactly like a link in an email: read the domain in the preview before opening it, and prefer typing the organisation's address yourself.
Search ads are bought for brand names, and an attacker who wins the auction for a bank's name places a lookalike login page above the real result. The ad is labelled, the domain is not the bank's, and the page is a copy. Use a bookmark for anything you log into rather than searching for it each time.
Voice calls and texts claiming to be from a bank's fraud team work by creating urgency and then directing you to "verify" through a code or a link. A genuine fraud team will never ask for a one-time code, a full password or a transfer to a "safe account". Hang up and call the number on your card.
Browser-in-the-browser pages draw a fake pop-up window, complete with a painted address bar showing the real domain, inside the phishing page itself. The tell is that the fake window cannot be dragged outside the browser's viewport and the real address bar still shows the attacker's domain. When a sign-in pop-up appears, look at the outer address bar, not the one inside the page.
The checks that hold up, in order
- Notice the pressure. If the message wants an immediate action through its own link, slow down.
- Find the real link. Long-press or hover; on desktop, copy the link address rather than clicking.
- Read the hostname from the right and identify the registrable domain. If it is not the brand's domain, stop.
- Look for
xn--, digits in place of letters, extra words, a bare IP or a shortener. Paste the URL into the checker when unsure; it also follows redirect chains to the final destination. - Do not use the link even if it passes. Open the site from your own bookmark or app and look for the same alert there; a genuine problem will be visible in the account.
- If you did enter credentials, change the password immediately from the real site, revoke sessions, and check whether the password was reused elsewhere.
Phishing rarely stands alone: it is how breached data is turned into account takeovers and how a first stolen password leads to the next. The breach response guide covers the follow-up wave of phishing that reliably arrives after any large leak, and the privacy hub connects the rest.
