Your bank emails you, but the message lands on the alias you gave only to a bookshop. Delete it. The bank never had that address, so the claim dies before you read a word. I run AliasFleet, an email-alias service that gives every site its own forwarding address, and that one comparison is the fastest phishing test there is: hold the sender's claim against the address it arrived on. The attacker controls the message. He never controlled the address. When the two don't match, you're done.
For everything that passes that test, or for anyone not on aliases yet, run the drill below. Sender domain first. Link destinations second. The ask last. The order is the point: the cheap mechanical checks come first, the judgment call comes last. Verizon's research, quoted by CNIC Solutions, puts the median click on a malicious link at 21 seconds, with 28 more seconds to enter data. The attack finishes inside a minute. The check fits inside the same minute.
Check one: the sender domain, read character by character
The name at the top is typed text. Anyone can write "Your Bank" as the display name; the mail system just carries it. What counts is the domain after the @. Tap or click the sender name to expose the real address, then read that domain letter by letter. Slowly. This is the whole check.
The fakes recycle a small set of tricks. Attackers are not creative here; they're just patient. A public mailbox doing company business: your "bank" writing from a @gmail.com address. A lookalike domain: CISA's own example is amazan.com; the working constructions run to letter-for-number swaps like paypa1.com or micros0ft-teams.net. And the brand name buried inside a longer address, billing@security-microsoft-update.com, where the real domain is security-microsoft-update.com and the word "microsoft" in the middle is decoration.
Then glance at Reply-To. It decides where your answer goes, and it can point somewhere the sender never mentioned. A convincing From address with replies routed elsewhere has identified itself; GingerSec's walkthrough flags the mismatch as a standalone tell.
The From header has a deeper story than a guide like this has room for. It is a claim, not a verified fact, and the authentication protocols behind it each check something narrower than most people assume. That mechanism is covered separately. For the 60-second drill, the summary holds: read the domain, not the name.
The alias test: compare the claim against the address
With one alias per site, the To line answers before you start thinking. A message claiming to be your bank, sitting on the alias you handed only to a bookshop, is forged on arrival. The bookshop is the only holder of that address. The bank never had it. There is no content analysis to do.
This isn't an AliasFleet invention. Apple's own guidance lists it as a phishing sign in plain terms: the email or phone used to contact you is different from the one you gave that company. The per-site habit just turns that advice into machinery. The address itself is the record of who was supposed to hold it, and it checks itself every time.
Two limits keep this honest. An alias cannot vouch for the sender: a forgery can still reach the correct alias if the attacker already knows it. And it only works going forward. The address map starts the day you begin; the personal address you've used for a decade sits in hundreds of databases, and no new habit retroactively sorts it. For the mechanics of addresses and leak tracing, see which website leaked my email and what an email alias is.
Check two: where every link actually points
The visible words on a link mean nothing. Blue underlined text can say your bank's name and point anywhere. The destination is the truth, and you can read it before clicking. On a computer, hover and read the address that appears. On a phone, press and hold to preview it, then cancel. Nesswick's guide documents the move for desktop and mobile; it takes two seconds and attackers hate it.
Read the destination's domain the way you read the sender: slowly. In secure-login.example-alerts.net/yourbank, the site is example-alerts.net, and "yourbank" after the slash is scenery. A link can look right while the URL doesn't match the company's site, which is the whole of the check.
Shortened links and QR codes hide where they go by design. That isn't proof of a forgery, but it's a reason to reach the company another way: the NCSC warns that criminals increasingly hide QR codes in phishing emails to get phones onto scam sites, where the address bar is harder to inspect.
One rule from Google closes this section: never enter a password after clicking a link in a message. If a click lands you on a login page, close it and type the address yourself. A padlock or HTTPS badge doesn't make a page trustworthy either. Certificates are free; anyone can get one for a fake domain.
Check three: what the message asks you to do
Every phishing email tells a story to get you to act. The FTC's guide lists the standards: suspicious activity on your account, a problem with your payment details, an invoice you don't recognise, a government refund, a prize you never entered. Hold the ask against one fact: legitimate companies do not email you a link to update your payment information. That sentence is nearly verbatim from the FTC, and on its own it kills most forgeries.
Pressure is the second tell. Urgency, suspension threats, a countdown clock: the message is trying to close the gap between reading and clicking before you think. A real organisation that needs something will let you walk in through the front door on your own schedule.
Two old tells are retired. Generic greetings like "Dear customer" prove little, since plenty of legitimate bulk mail is impersonal too. And bad spelling is dead as a signal: CISA says plainly that AI tools now write perfect grammar, so a well-written email proves nothing. Judge the sender, the links, and the request. Never the prose.
Picture the careful version of the mistake. You don't click the link in the "bank" email because you know better. Instead you call the number printed at the bottom of the message to check. A polite voice answers, asks you to confirm your card number and the code from your texts, and thanks you. You have just handed everything to the same attacker, because the number, the link, and the reply address were all his. That is why the rule underneath the other three checks is absolute.
Never use a phone number, link, or reply address inside a suspicious message to verify that message. They all lead back to the attacker. Verify through a route the message cannot touch: the company's app, a number on your card or statement, or an address you type yourself into a fresh browser tab.
When the three checks are not enough
A clean domain, clean links, and a plausible ask can still be a forgery, and the commonest case is the real template in the wrong hands. Post-breach phishing copies the genuine notice word for word, so content checks stop working and only the channel decides. That case is covered separately. For one suspicious message, two escalation paths remain.
The deeper evidence lives in the headers: the Received chain and the authentication verdicts. The header guide walks through opening them in Gmail and Outlook and reading them in about a minute. If the headers still leave doubt, treat the doubt as the answer and use the independent channel anyway.
Then report it. In Gmail, open the message, click More next to Reply, and choose Report phishing; Google feeds it into its filters. The FTC asks that phishing mail be forwarded to reportphishing@apwg.org and reported at ReportFraud.ftc.gov. In the UK, the NCSC asks people to forward suspicious mail to its dedicated reporting address. Reporting takes under a minute and sharpens the filters for everyone behind you.
If you already clicked: close the page and enter nothing more. If you entered a password, change it on the real site, and everywhere else you reused it, through the official app or an address you type yourself, never the link. Switch on two-factor authentication. If you shared payment details, call your card issuer on the number printed on the card. Then run the address through Have I Been Pwned and watch the accounts for a few weeks.
What this check cannot catch
Three gaps stay open, and saying so is part of the deal. A forgery can land on the correct alias if the attacker already holds that address; the alias names the source, it doesn't vouch for the sender. A message from a compromised real account passes every reader-side check, because the sender is genuine even though the content isn't. And no 60-second routine replaces the independent channel: when the message matters, open the app or type the address yourself, which is the same rule the University of Reading's phishing checklist ends on. The check above catches the common case. The channel habit catches the rest.
If you want the habit that makes the alias test automatic, the set-up guide takes about two minutes per method. One alias per site, and the To line starts running check one before you do.
