What phishing is and how to spot scams

An email arrives from "HR" asking you to confirm your bank details on a new portal before 6 PM, or your payment will be delayed. The sender's domain is hr-company-payments.com instead of your company's domain, but you're in a hurry and the button is big and blue. That's exactly how most breaches start: not with a sophisticated zero-day, but with a tired person clicking a link under pressure. Phishing doesn't break into the system; it breaks into you.

This article is about recognizing the signs before the click and what to do if you've already clicked. The defense is technical too: understanding how password hashing works helps you see why reusing a password is what turns an isolated phishing hit into a cascading disaster.

Phishing is social engineering, not an exploit

The most common confusion is treating phishing as a technology problem. It isn't. The attacker doesn't break encryption or exploit a bug — they convince you to hand over the credential willingly. The "vulnerability" being exploited is human: urgency, authority, fear, curiosity. That's why a firewall and antivirus don't solve it on their own; they see nothing anomalous in a login that you performed voluntarily on a site that looks legitimate.

Understanding this changes your stance: the defense isn't only technical, it's the habit of distrusting requests that manufacture urgency.

The signs that give the scam away

No single sign proves fraud, but the combination raises the alarm:

• Sender domain. The display name might say "Bank X," but look at the actual address. support@bank-x-security.net is not bank-x.com.
• Artificial urgency. "Your account will be locked in 24h," "pay now or lose the discount." Haste is the scammer's main tool — it stops you from thinking.
• Link that doesn't match the text. The text says bank-x.com but the real destination is something else. Hover (without clicking) and read the URL in the status bar.
• Look-alike domains. paypa1.com with the "L" turned into a "1," or arnazon.com with "rn" mimicking "m." Haste hides this.
• Punycode. Domains with Unicode characters that render identical to Latin letters. аpple.com with a Cyrillic "а" is not apple.com, but it looks the same to the eye.

Inspect the URL before clicking

When a link comes shortened or with a pile of encoded parameters, it's worth decoding before you follow it. Attackers use URL encoding to hide the real destination or malicious parameters inside a link that, at first glance, looks harmless. A link like https://login.example.com/?next=%68%74%74%70%3a%2f%2fevil%2e... hides the redirect inside next.

Copy the link (right-click → copy address, without clicking) and run it through a URL decoder to read what's actually there. Decoding the percent-encoding reveals the final domain and any embedded redirect parameters. If the decoded destination differs from what the email promised, you just caught the scam before falling for it.

Rule of thumb: never trust the visible text of a link, trust only the final decoded URL — and when in doubt, type the bank's or service's address yourself in the browser instead of clicking.

Spear phishing: the tailored attack

Mass phishing is crude and easy to catch. Spear phishing, on the other hand, is personalized: the attacker researched your name, your role, who you talk to. The email comes "from your manager" requesting an urgent transfer, citing a real project they found on LinkedIn. Against this, generic signs help less — the defense is to verify through a separate channel. Got an unusual financial request by email? Call the person. Never approve a transfer based solely on the message that arrived.

Why 2FA and a password manager blunt the scam

Two technical defenses drastically reduce the damage:

• 2FA (two-factor authentication). Even if the attacker captures your password on the fake site, without the second factor they don't get in. Prefer an authenticator app or a physical key (FIDO2) — SMS is better than nothing, but it's interceptable.
• Password manager. Beyond enabling a unique password per site (preventing the cascade effect), it only fills credentials on the exact saved domain. On a look-alike site paypa1.com, the manager simply doesn't offer autofill — and that absence is a powerful alert your tired eyes would ignore.

Notice how this connects to hashing: reused passwords mean a single successful phishing hit becomes a master key to dozens of your accounts.

I clicked. Now what?

Panic doesn't help, speed does. In order:

1. Don't type anything else on the suspicious site. If you already entered the password, it's compromised.
2. Change the password for the affected service immediately — and for any other site where you reused the same one.
3. Enable or verify 2FA on the affected account.
4. Tell who needs to know: company IT, the bank, or the service, depending on the case.
5. Monitor recent logins and active sessions; terminate any session you don't recognize.

The faster you rotate the credential, the smaller the window the attacker has to use it.

Frequently asked questions

How do I know if a link is safe before clicking?

Hover over it without clicking and read the real URL in the status bar. If it comes shortened or full of encoded parameters, copy the address and decode it in a URL decoder to see the final destination. When in doubt, type the official address yourself in the browser.

Does 2FA make me immune to phishing?

It greatly reduces the risk, but it's not total immunity. 2FA via authenticator app or physical key defeats most attacks, because the password alone isn't enough. More advanced real-time reverse-proxy attacks can bypass some methods, which is why a FIDO2 physical key is the most resistant standard.

What is punycode and why does it matter in phishing?

Punycode lets attackers register domains with Unicode characters that render visually identical to Latin letters, like a Cyrillic "а" in place of the Latin "a." The domain looks like apple.com to the eye, but it's a different address underneath. That's why checking the decoded domain, not just what's displayed, matters so much.

I clicked a phishing link but didn't type anything. Am I compromised?

Probably not, if you only opened the page and didn't enter a credential or download/open a file. The biggest risk of the click alone is confirming to the attacker that your address is active. Still, run an updated antivirus and watch for automatic downloads that may have been triggered.

What to take from this read

Phishing wins on haste, so the defense starts by slowing down: no urgent request deserves an immediate click. Look at the sender's real domain, distrust manufactured urgency, and decode any suspicious link before following it — the real destination rarely matches the text. On the technical level, 2FA and a password manager turn a wrong click from catastrophe into a manageable incident, and a unique password per site prevents the cascade effect. If you've already clicked and typed, rotate the credential immediately. The attacker is betting you're too rushed to look; proving them wrong is the whole defense.