Recognition framework
The 3-second triage
Three questions, in order, on every message. Most decisions end here.
1 Ask — what does it want me to do?
Every phishing message wants an action: click, open, pay, approve, reply, call. Name the action first. If there is no action, there is no attack.
2 Channel — is this how this arrives normally?
A request that would normally come through a system arriving by email, chat or phone is the anomaly, independent of how well it reads.
3 Verify — can I confirm this without using anything in the message?
Bookmark, directory number, the app itself. If the only route to confirmation is inside the message, you have not verified anything.
The 7-point sweep — SPA-LATCh
When the triage does not settle it, sweep in this order. Roughly 20 seconds.
| Point | Question | What to look at | Typical tell | |
|---|---|---|---|---|
| S | Sender | Is this who it says it is? | Full address, not display name. Registrable domain. Reply-To vs From. Did the address change mid-thread? | Display name matches a colleague; domain does not |
| P | Pretext | Does the story hold? | Would this person, in this role, raise this matter, this way? Is confidentiality being used to prevent verification? | A reason you must not check with anyone |
| A | Ask | What am I being asked to do? | Credentials · money · bank details · approval · permission · a code · install · run · scan · call | Bank-detail change, or any credential or consent |
| L | Link | Where does it really go? | Read back from the first single slash past the public suffix (.ch, .co.uk) — the label before it is the owner. Redirect parameters. Shorteners. CAPTCHA gates. | An authentication prompt reached by clicking |
| A | Attachment | Does the file type match the story? | .htm / .html / .svg · password-in-body archives · .iso / .img · double extensions | A .htm, .svg, or a password-protected archive |
| T | Timing | Why now, and why so fast? | Deadline, cut-off, threat of loss. Out-of-hours. Just before a payment run or a holiday. | A deadline on a normally unhurried process |
| C | Channel | Is this the right pipe for this content? | Internal matter arriving externally. Work request on a personal app. Money request by voice only. | A channel switch that prevents verification |
Five verification habits
Each defeats whole families of attack at once, regardless of how the lure was written.
| Habit | What it defeats | Why it works |
|---|---|---|
| Self-navigate | Never authenticate from a link, document, QR code or message. Bookmark, typed address, or app — every time. | bulk, clone, quishing, AiTM, file-share, calendar, malvertising |
| Call back on a number you already have | For every bank-detail or payroll-destination change, and every payment above threshold — without exception and without social cost. | payment-diversion BEC, invoice fraud, CEO fraud, payroll diversion, vishing, voice cloning, deepfake |
| Cancel by default on anything you did not start | If you did not deliberately begin this — a permissions grant, a sign-in confirmation, a code-entry page — decline it. Starting it yourself is the only thing that makes it yours. | consent phishing, malicious OAuth app consent |
| Never approve, read out or run anything a human asked you to | Codes go to you, not through people. Websites do not fix computers. | device code, MFA fatigue, ClickFix, help-desk impersonation |
| Report fast, including after the fact | A stolen session can be revoked in minutes. “I already clicked” must be the easiest thing to say in the organisation. | limits damage from everything above |
Advice to retire
These were once useful. They now produce false confidence.
| Retired advice | Why it fails now | What replaces it |
|---|---|---|
| Look for spelling and grammar mistakes | AI generates flawless localised copy at bulk cost; some campaigns insert errors deliberately to defeat this heuristic. | Judge the ask, channel and relationship — never the prose. |
| Check for HTTPS / the padlock | Certificates are free and automated. The large majority of phishing sites have valid HTTPS, and AiTM proxies serve perfect certificates for their own lookalike domains. | Read the registrable domain — better, don't read links at all. |
| Beware generic greetings | Personalisation is automated from breach data. Meanwhile real bulk notices are genuinely generic. | Personal detail is not authentication. |
| Hover over links to check them | Defeated by open redirects, subdomain deception, homoglyphs, shortener chains — and absent entirely on mobile and QR codes. | Self-navigation is the control; hovering is triage at best. |
| MFA protects you from phishing | AiTM relays your real sign-in through a reverse proxy: you authenticate and complete MFA against the genuine site, and the proxy keeps the resulting session cookie. Consent and device-code phishing need no factor at all. | MFA is not equal. Only origin-bound factors — FIDO/WebAuthn passkeys, or certificate-based auth — resist phishing, and only where weaker fallback methods are switched off. |
| Don't open attachments from strangers | Most dangerous attachments now arrive from people you know, via compromised mailboxes, inside real threads. | File type must match the story. Type-based rules, not sender-based. |
| Phishing is always urgent | The best spear phishing is deliberately unhurried — some lures explicitly say “no rush”. | Urgency is evidence when present, not reassurance when absent. |
| If it looks professional it's real | Attacker templates are frequently cleaner than real internal comms. | Production quality carries zero signal. |