The message that looks right

  • A polished bank alert
  • Why appearance is weak evidence

A message arrives from your bank. It uses your name. The logo is crisp. The grammar is perfect. It says a new device has signed in and gives you one reassuring blue button: Review activity.

Seven seconds from now, you could be on a convincing copy of the bank's website. Or you could spot the trick without becoming a URL expert. Today, I want to give you a routine short enough to use while the message is still trying to rush you.

This is Breach Signals from Scan.now, practical security for the web you use every day. I'm Andrew.

The old picture of phishing is an email full of spelling mistakes from a stranger making an unbelievable promise. That still exists, but it is a poor mental model for the difficult cases. A polished message is cheap. A copied logo is free. A sender name is merely a label. The more reliable signal is not how the message looks. It is what the message wants you to do, and where it wants you to do it.

The seven-second check

  • Notice the requested action
  • Leave the message and choose a known route

Here is the seven-second check.

First: stop at the action. Is the message asking you to sign in, move money, open a file, share a code, or fix something before a deadline? Urgency is not proof of fraud. Real services do warn about real problems. But urgency is the lever that makes every other clue easier to miss. Notice the lever before you inspect the link.

Second: leave the message. Do not use its button to investigate its claim. Open the bank's app yourself, use a bookmark, or type the address you already know. If there really is a security alert, it should be waiting inside the real account. This is the most valuable part of the routine because it works even when you cannot confidently read a complicated address.

Third: if you still need to inspect the link, find the actual domain, not the words that merely surround it.

Imagine the address is accounts dot bank dot example dot security-check dot com. Read it from right to left. Dot com is the ending. The name immediately before it is security-check. That is the registered domain. Everything to its left can be chosen by whoever controls security-check dot com. The word bank may be prominent, but it does not make this the bank's website.

Read a domain from right to left

  • Find the registered domain
  • Why a padlock does not prove identity

Now compare that with security dot bank dot example dot com. Reading from the right, example is the registered name and bank and security are subdomains beneath it. Whether that is legitimate still depends on who owns example dot com, but the structure is different. The important boundary sits just before the public suffix, such as dot com, dot org, or dot co dot uk.

Attackers exploit the fact that people read addresses from left to right. They put the trusted word early, then let attention fade before the part that controls the destination. On a phone, the address may also be shortened or pushed off-screen. Pressing and holding a link usually reveals a preview, but even that is a reason to pause, not a reason to continue. A familiar word is not ownership.

What about the padlock? It tells you the connection to the current site is encrypted. It does not tell you that the site belongs to your bank. A phishing site can obtain an ordinary TLS certificate and show the same lock. Encryption prevents someone between you and the site from reading the conversation. It does not make the person at the other end honest.

This is why the Federal Trade Commission's advice is so effective: contact the company using a phone number or website you already know is real, not the information in the unexpected message. That instruction bypasses the attacker's carefully built path.

Suppose you clicked before you stopped. Do not panic, and do not treat every click as a completed theft. Separate what happened.

What to do after a click

  • A click, download and submitted password are different events
  • Sessions and recovery routes

If the page opened and you entered nothing, close it. If a file downloaded, do not open it. Delete it or scan it first. Update your browser and security software if either is behind. The click may have told the sender that your address is active, so expect follow-up messages, but a click alone is not the same as surrendering a password.

If you entered a password, go to the real service through its app or a known address and change that password now. If you reused it anywhere else, change those accounts too, starting with your email. Your email is the reset key for much of your digital life.

Then review active sessions and sign out devices you do not recognise. Many services let you revoke every session at once. Check recovery email addresses, phone numbers, forwarding rules, and any new multi-factor methods. Changing a password is not enough if the attacker added their own recovery route while they were inside.

If you entered a one-time code, speed matters. A criminal can relay that code to the real service while it is still valid. Contact the service through a known route and treat the account as compromised until its sessions and recovery settings have been reviewed.

Codes, passkeys and phishing resistance

  • Why manual codes can be relayed
  • How passkeys bind authentication to the real site

Multi-factor authentication is still worthwhile. It stops an attacker who has only a password. But not every second factor resists a live phishing page. The current NIST digital identity guidance makes a sharp distinction: a code that you manually copy can be relayed, while phishing-resistant authentication binds the proof to the real service. Passkeys and hardware security keys can provide that binding. In plain language, the browser and authenticator check which site is asking. A convincing copy on the wrong domain cannot simply forward the same proof.

That does not mean you must replace every login today. Start with the accounts whose loss would unlock the rest: primary email, password manager, financial accounts, work identity, and cloud storage. Where a passkey or security key is offered, it is more than convenience. It removes part of the judgement burden from a tired human reading a tiny address bar.

There is one more clue worth knowing: the message's displayed sender is not a verdict. Email systems have mechanisms called SPF, DKIM, and DMARC that help receiving providers check whether a message was authorised and whether its signed identity aligns with the visible From address. Those controls stop a great deal of simple spoofing. They do not stop a criminal from registering a lookalike domain, compromising a legitimate mailbox, or using an ordinary consumer address with a persuasive display name. Treat the inbox as a delivery channel, not a trust boundary.

So here is the whole routine once more.

Notice the requested action and the urgency around it. Leave the message instead of following its route. Open the app, bookmark, or known website yourself. And when you inspect an address, read the meaningful domain from right to left.

Check it with Scan.now

  • Use the phishing URL checker
  • The rule to remember before the next message

The best phishing defence is not the ability to identify every fake. It is a habit that makes the fake irrelevant. You do not have to decide whether the blue button is genuine if you never use the button to resolve the warning it delivers.

On Scan.now, the phishing URL checker can safely follow a suspicious link's redirects and explain lookalike-domain signals without submitting anything on the page. The companion guide, How to Spot Phishing, shows the domain examples in writing. You will find both on the episode page at scan dot now slash podcast.

Next time on Breach Signals: private browsing is useful, but it is not a cloak. We will follow exactly what disappears when the window closes, and what every website, network and employer can still see.

Until then, when a message creates a deadline, give yourself seven seconds and choose your own route.