Check who it's really from

The "from" field of an email is a claim, not a fact. Treat it that way.

Display names are decoration

Every email has a display name (what your mail client shows, such as "Amine Amrani" or "Microsoft Support") and an underlying address. The display name is chosen freely by the sender, so an attacker can set theirs to anything at all. On mobile, many mail apps show only the display name by default, which is one reason phishing succeeds more often on phones. Always expand or tap the sender to see the actual address before acting on a sensitive request.

Spoofed addresses

In some cases attackers can forge the sending address itself, so the email appears to come from a genuine domain. Modern email authentication (SPF, DKIM, and DMARC) blocks much of this, but not all organisations have it configured properly. This is why the sender address alone is never complete proof, and why the content and context of a message matter as much as its origin.

Lookalike domains

Far more common is the lookalike domain: an address that is almost, but not quite, right. Watch for:

• Swapped or doubled letters: micros0ft.com, paypa1.com, arnrani.tech where "rn" imitates "m"
• Extra words: yourbank-security.com, hmrc-refunds.co.uk
• Wrong endings: a .net or .info where you would expect .com or .co.uk
• The real name buried in a subdomain: yourbank.com.secure-login.xyz, which actually belongs to secure-login.xyz

Read domains from right to left. The part that matters is the registered domain just before the final ending, not whatever familiar words appear earlier in the string.

Reply-to mismatches

An email can arrive from one address but be configured so your reply goes somewhere else entirely. If you hit reply and the address in the "to" field is not the one you expected, stop. This trick is a staple of invoice fraud, where the attacker wants to hold a conversation with you without the real supplier ever seeing it.

None of these checks takes more than a few seconds. Together they catch a large share of everyday phishing before you ever need to think about the message itself.