Scam emails stopped being obvious some time ago. The spelling is fine, the logo is right, the layout matches the real thing, and the sender address looks close enough to pass a glance. What has not changed is the underlying shape: something urgent, something to click, something to log into. Learning to spot scam emails is mostly about recognizing that shape rather than catching a typo.
Copying a company's email design takes minutes, because the design is sitting in every genuine message they have ever sent. Judging by how professional something looks is therefore judging by the one thing that is trivially faked.
The reliable phishing email signs are structural: what the message wants, how quickly it wants it, and whether it arrived in response to anything you did. A perfectly formatted email demanding immediate action on an account you were not thinking about is far more suspicious than a plain one with a spelling mistake.
Never reach an account through a link in a message. Not once. If an email says your bank needs attention, close it, open the banking app or type the address yourself, and look. Either the alert is there or it was not real.
This habit works because it does not require you to judge anything. You can be tired, distracted, or half-convinced, and it still holds. Every list of email safety tips contains a dozen checks; this single rule covers what most of them are trying to catch.
The same approach applies beyond email, and the phone version is harder because a voice creates pressure a message cannot. Nobody legitimate will object to being called back on a number you looked up yourself, and anyone who does object has told you what you needed to know.
Messages claiming to be from a family member on a new number are a common variation. A question only the real person could answer settles it in seconds, and most guides on avoiding scams recommend agreeing that check in advance rather than improvising it under pressure.
Clicking a link alone is usually survivable. Entering details is the point where it matters, and speed then counts for a great deal.
Change the password on that account immediately, and anywhere else the same password was used. Turn on two-factor authentication while you are there. If card or bank details were entered, contact the bank straight away — they deal with this daily and can act faster than you can. Then watch the account for small unfamiliar charges, which are often tested before larger ones. Reporting it to the provider and to the organization being impersonated takes a minute and genuinely helps.
Treat every unexpected message that wants urgent action as unverified until you have reached the account independently. Check the domain before the first slash, never log in through a link, and assume that anything creating pressure is doing so deliberately. That is enough to defeat the overwhelming majority of attempts without becoming an expert in any of it.
There is a steady run of security write-ups on FactMates too.
