Recognising the warning signs

A few patterns cover most phishing and malware attempts you'll actually encounter:

• A sense of urgency or a threat ("act within 24 hours" or "your account is suspended")
• A request that skips normal process, e.g. a payment approval outside the usual system
• A link where the visible text doesn't match where it actually goes, hover over it before clicking
• An unexpected attachment, especially one that needs you to "enable content" or "enable macros" to open
• A sender address that's almost right but not quite, a lookalike domain, an extra letter, a different top-level domain

None of these alone proves something is malicious, but two or three together is a strong signal to stop and verify before acting.