Why Phishing Beats Every Firewall
Every major breach you've heard of started the same way: not with a code exploit, but with a human clicking something. Phishing is the cheapest attack in existence — a template, a lookalike domain, and a sense of urgency — and it works on brilliant people because it hacks attention, not computers.
The defense is a single trained reflex: when a message wants action + urgency + credentials/money, verify through a known channel before doing anything. Not after reading it. Before. Everything below is practice for that reflex.
Six Real Examples, Dissected
1. 'Your package is held — $1.99 customs fee.'
The tell: you don't have a pending package (or you do — and carriers never collect tiny fees by text link). The link goes to a card-skimming page that also steals the 'tracking' login. Check: no payment link ever arrives by unsolicited SMS.
2. 'Payroll details expired — update your direct deposit.'
The tell: HR doesn't handle payroll changes by email link, and the sender domain is one letter off (payroII vs payroll — look closely at the l's). This one empties bank accounts: 'update' redirects your salary to the attacker's account. Check: walk to HR's real system (or intranet) yourself.
3. 'Boss: I'm in a meeting, buy 5 x $200 gift cards, send codes.'
The tell: executives don't assign gift card purchases by text, and urgency + secrecy is the con's signature. The sender spoofed the display name. Check: any money or credentials request gets verified by voice — a call to the real number, not the one in the message.
4. 'Your account shows login from Moscow. Secure it now.'
The tell: the fear is the payload. The link asks you to 'verify' — handing over the credentials the 'security alert' claims to protect. Check: never via the email. Open the real app or type the site address yourself; a genuine alert will be there.
5. 'Invoice overdue — see attached.'
The tell: the attachment is a macro-laden Office file or a fake-PDF that's actually a credential page. Businesses receive it daily; it works because bookkeepers process invoices all day. Check: no invoice from an unknown vendor gets opened without verifying the vendor exists.
6. 'MFA code sent — enter it to approve login' (that you didn't trigger).
The tell: if a code arrives unprompted, someone IS logging in — with your stolen password, and the code is the last gate. Entering it approves them. Check: deny the prompt, change that password immediately, see our 2FA guide.
The 10-Second Check (Works on Everything)
Before touching any link or attachment from a message that wants something:
- Hover the link (long-press on mobile) and read the actual domain — not the display text.
paypal.com.verify-login.ruis not PayPal. The real domain is the last part before the first single slash. - Read the sender's full address, not the display name. Display names are costume parties; the address after @ is the face.
- Ask the two questions: Did I expect this? Does it want urgency + credentials/money/action? Two yeses = verify through a known channel first. Every time.
Ten seconds. This reflex alone defuses the six examples above and 95% of everything you'll ever receive.
Build the Human Firewall
- Family plan: teach the two-question check to parents (the most phished demographic) and kids. The 'grandparent scam' and package-text waves are phishing wearing different clothes.
- Work plan: report suspicious mail through your security tool instead of just deleting — every report hardens everyone's filters.
- Reduce the blast radius anyway: unique passwords (our manager comparison) and passkeys/2FA (our 2FA guide) mean that even a successful phish yields nothing usable. Defense in depth: the reflex first, the layers behind it.
