How to spot phishing emails (and what to do if you clicked)

Phishing works because it borrows trust. The message looks like your bank, your supplier or your own IT department, and it asks for something ordinary: confirm a password, approve a payment, open an invoice. The defence is not cleverness — it is a habit of checking two or three things before acting.

The signals

Urgency and threat. "Your account will be closed in 24 hours." Real institutions rarely impose deadlines by email, and never for account closure.

A request that skips the normal process. A supplier asking you to pay a new bank account, a manager asking for gift cards, a colleague asking for a password — all bypass procedures that exist for a reason.

Mismatched links. Hover over the link (or long-press on a phone) and read the actual domain. secure-bank-login.example.com is not your bank; the part immediately before the final dot is what matters.

Slightly wrong sender domain. micros0ft.com, yourbank-support.com, company.co instead of company.com. Displayed names can say anything — read the address itself.

Unexpected attachments, particularly documents that ask you to enable macros, or archives containing an executable.

Generic greetings and odd phrasing. Less reliable than it used to be — machine-written phishing is fluent now — but still a signal when combined with the others.

Why a valid sender proves nothing

Authentication (SPF, DKIM, DMARC) confirms that a message really came from the domain it claims. It does not confirm the domain is trustworthy: an attacker can register a lookalike domain and authenticate it perfectly. Conversely, a compromised mailbox at a genuine company sends perfectly authenticated fraud. Treat authentication as one signal among several, not as proof.

Verify through a second channel

The single most effective habit: when a message asks for money, credentials or a change of bank details, confirm it by a channel you already trust — a phone number you looked up yourself, not the one in the message. Two minutes on the phone defeats nearly every business email compromise attempt.

If you clicked

Act in this order:

1. Change the password for the affected account, from a device you trust. If you reused it anywhere, change it there too.
2. Check active sessions and app passwords, and revoke anything unfamiliar.
3. Turn on two-factor authentication if it was not already enabled.
4. Check your mailbox rules. Attackers commonly add a forwarding or auto-delete rule to hide their activity.
5. Tell someone — your IT contact, your bank, or the supplier whose identity was used. Speed limits the damage.
6. Run a malware scan if you opened an attachment.

Frequently asked questions

Is it dangerous just to open the message? Opening is usually safe in a modern client. Danger comes from clicking links, opening attachments and enabling content.

How can I check a link safely? Read the domain without clicking. If you must visit, type the address yourself rather than following the link.

Should I report phishing? Yes — mark it as phishing in your mail client, and forward it to your IT or security contact. Reports improve filtering for everyone.

Are targeted attacks different? Yes. Spear phishing references real projects and real colleagues. That is exactly why the verify-by-another-channel rule matters more than spotting typos.

Protection at imail.com.tr

imail.com.tr checks inbound mail against sender authentication and reputation signals, and supports two-factor authentication on every mailbox. For the account side of your defences, see our 2FA guide; to start with a clean, ad-free mailbox, create a free account.