Phishing is a social-engineering attack where someone impersonates a trusted party — a bank, IT support, a colleague — to trick you into a risky action: sharing a password, clicking a malicious link, or sending money. It doesn't rely on breaking software; it relies on manufacturing urgency and trust convincingly enough that careful verification gets skipped.
The common red flags
Urgent Language
"Your account will be locked in 24 hours" creates pressure to act fast, which is exactly when people skip careful checks.
Mismatched Domains
A From address on one domain and a Reply-To on a slightly different, look-alike domain is a classic spoofing tell.
Credential Requests
Legitimate services essentially never ask you to "confirm your password" by clicking a link in an email.
Reading the headers, not just the message
The email body is only half the picture. Headers carry technical signals: whether SPF (Sender Policy Framework) passed or failed for the sending domain, whether a DKIM signature is present and valid, and whether the Reply-To address actually matches the From domain. An SPF softfail, a missing DKIM signature, and a Reply-To that lands on a different domain than the sender, taken together, are a strong spoofing signal — even if the message text alone looks convincing.
Why awareness training alone doesn't stop it
Phishing keeps working not because people are careless, but because it's engineered around psychology, not technology. A message designed to trigger urgency and trust bypasses the same rational scrutiny that would catch an obviously fake request under calmer circumstances. That's why the practical defense is a habit — slow down and check the headers — rather than just "being more careful," which is hard to sustain under manufactured pressure.
Where to practice this
The Phishing Email Analysis Challenge walks through exactly this kind of header analysis on a safe, static, fictional example — matching the From/Reply-To domains, checking SPF and DKIM, and identifying the bad destination link.