1. Spot and Resist Urgency
- Analyze the tone: Phishing emails often use high-pressure language demanding immediate action to avoid account suspension or claim a prize.
- Slow down: When a message demands instant compliance, pause and investigate rather than reacting impulsively
2. Verify the Sender and URLs
- Inspect addresses: Check the sender’s full email address for subtle typos, such as amaz0n.com instead of amazon.com.
- Hover before clicking: Hover your mouse over any link to preview the actual destination URL before clicking it
3. Navigate Directly to Official Sites
- Bypass email links: Never click on links within a suspicious email to log into an account.
- Use trusted paths: Type the official web address directly into your browser or use a pre-saved bookmark
4. Enable Multi-Factor Authentication (MFA)
- Add a layer: Turn on MFA for all of your email, banking, and social media accounts.
- Block attackers: MFA ensures that even if a scammer steals your password, they cannot access your account without your secondary verification code
5. Never Share Sensitive Credentials
- Protect keys: Legitimate companies will never ask you to reply with your password, Social Security number, or one-time PINs via email.
- Use password managers: Rely on a password manager, which will automatically refuse to autofill your credentials on a fake phishing domain
