2.1Email phishing
The essentials in 30 seconds
- The display name proves nothing: only the sender's full domain counts — read the domain, not the name.
- Hover before you click: the real URL shows on hover — 30 seconds of inspection neutralizes the #1 vector.
- Never log in from a received link: type the official address yourself or use your bookmarks — a received link is never an entry point.
Threaded mini-case — Karim receives a fake email from his bank in Algiers
Karim, an office worker in Algiers, opens an alarming email signed with his bank's name: “suspicious activity, confirm your identity by clicking here”. In a hurry, he is about to click. He thinks again and applies the 5-point inspection: the sender's full domain has nothing to do with the bank, the hovered link leads elsewhere, and the message plays on urgency. He does not click, logs in via his bookmarks (nothing unusual) and reports the message to IT. This same Karim returns in 2.2, 2.3, 2.4 and 2.5.
Simplified teaching model: this fake message illustrates the signs to spot, not a real attack. This same case returns in the lesson, the diagram, the script and the 48h challenge — and continues in 2.2, 2.3, 2.4 and 2.5.
1. The #1 threat by volume
Phishing remains the #1 threat by volume: an email imitating the bank, the telecom operator, HR or the boss, asking you to click, fill in a form or approve a transfer. Karim saw it himself: the message looked exactly like his bank. Spear phishing (targeted, personalized with name, projects, habits) is far harder to spot than mass spam.
2. Red flags
Inspect: the sender's full address (the display name proves nothing), the real URL of links (hover without clicking), the feeling of urgency, requests for credentials or payment, and context consistency (were you expecting this message?). Watch for lookalike domains (one changed letter fooling the hurried eye) and harvesting pages (fake login pages where you “hand over” your password).
3. The golden rule
Never log in from a received link: Karim types the official address himself or uses his bookmarks. What reaches your inbox has already passed the filters: personal inspection is the last line of defense. Clicked without entering anything? Enter nothing, close, report to IT and monitor the account; if you entered credentials, change the password immediately and report (see 5.1).
🔎 Concrete example — 🔎 Concrete example — The 5-point inspection
Karim's checklist facing his bank's fake email (teaching model):
1) Sender's FULL address (not the display name).
2) Hover over each link without clicking (real URL?).
3) Urgency/fear/windfall? 4) Credentials/payment request?
5) Consistent context (was I expecting this message)?
→ Karim does not click, checks via his bookmarks, reports to IT.Takeaway: 30 seconds that neutralize the #1 vector.
Lesson: log in via your bookmarks, never via the received link.
Section vocabulary
- Phishing
- Fraudulent email imitating a trusted third party (bank, courier, colleague, public service) to steal credentials or install malware.
Simple example: Karim receives a fake email from his bank asking him to “confirm his identity”.
What it is not: an expected, consistent email from a known colleague, with no strange request.
Reflex: urgency + credentials or payment request = phishing until proven otherwise.
- Spear phishing
- Targeted, personalized phishing (victim's name, projects, habits), far harder to spot than mass spam.
Simple example: An email quoting Karim's real project to lull his suspicion.
What it is not: generic mass spam with obvious mistakes.
Reflex: the more personalized it is, the more you check domain and context.
- Spoofed sender address
- An email's display name is free text and proves nothing: only the full domain of the address counts.
Simple example: “Your Bank” displayed can hide an address unrelated to the bank.
What it is not: the pretty logo or official signature at the bottom of the message.
Reflex: always display and read the full address, not the name.
- Lookalike domain
- Address almost identical to the official one, one letter off, fooling the hurried eye.
Simple example: A domain resembling the tax office or a known brand, with one modified character.
What it is not: the exact official domain, verified character by character.
Reflex: reread the domain slowly, especially after a received link.
- Harvesting page
- Fake login page, a perfect copy of the real one, where the victim “hands over” their password to the attacker.
Simple example: Karim would have entered his login details on a copy of his bank's site.
What it is not: the real page reached via his bookmarks or the typed address.
Reflex: never enter credentials from a received link.
In practice — In practice — The 5-point inspection of a suspicious email
- Take a commercial email received recently and inspect the sender's FULL address (not the display name) — is the domain exactly right?
- Hover over each link WITHOUT clicking: does the destination URL match the official site?
- Does the message create urgency, fear or an unexpected windfall? Are you asked for credentials, payment or data? Is the context consistent (were you expecting this message)?
- Train yourself: Google's online anti-phishing test (“phishing quiz”) makes excellent practice.
Ready-to-say script — reporting a suspicious email to IT (30 s)
“Hello, I just received an email that looks suspicious: the sender shows the name of [bank / service], but the full domain does not match, and it asks to click an urgent link. I clicked nothing and entered nothing. I am forwarding it to you for verification — should I also use the Report button in my mail app?”
Say (or write) without clicking or entering anything; forward the original message as an attachment if possible.
Copy-paste template — 5-point inspection checklist
SUSPICIOUS EMAIL DATED: _______________
1) SENDER (full address): _______________ / Exact domain? YES / NO
2) LINKS (hovered URL, no click): _______________ / Official site? YES / NO
3) EMOTION (urgency / fear / windfall): _______________
4) REQUEST (credentials / payment / data): _______________
5) CONTEXT (expected, consistent message?): _______________
DECISION: do not click → verify via bookmarks → report to ITSmall business / tight budget
With no advanced tool: the 5-point inspection on every sensitive email is enough — the reflex costs nothing.
SME in Algeria
Karim checks via his bookmarks even on mobile, and alerts his IT contact at the slightest doubt.
Large company / filtered mail
Even with powerful filters, what reaches the inbox has passed them: inspection stays mandatory.
Remote work / BYOD
On a phone, check the full address and URL with a long press: never click in a hurry.
✓ Best practices
- Check the full domain, not the display name.
- Hover over links before any click to see the real URL.
- Log in via your bookmarks, never via a received link.
✗ Common pitfalls
- Trusting the sender display name.
- Clicking a “bank” link then entering credentials on the page.
- Believing spam filters block everything (not spear phishing).
Key takeaways
- The sender display name proves NOTHING: check the full domain.
- Hover over links before any click: the real URL shows on hover.
- Urgency + credentials/payment request = phishing until proven otherwise.
- Never log in from a received link: type the official address yourself or use your bookmarks.
48h Challenge - apply tomorrow
Take 3 recent emails containing a link and run each through the 5-point inspection with the template above (domain, hovered URL, emotion, request, context). Note the average time and report any dubious message to your contact.
- I can quote the 5 inspection points without hesitating.
- I can explain why the display name proves nothing.
- I inspected 3 real emails and flagged 1 possible doubt.
Frequently asked questions
I clicked a phishing link but entered nothing: what now?
Enter nothing, close the page, report to IT and monitor the account concerned. The click alone is rarely enough for compromise — entering credentials is: in that case, password changed immediately + report (see 5.1).
Don't spam filters already block everything?
They block most of the volume, not crafted attacks or spear phishing. What reaches your inbox has precisely passed the filters: your inspection is the last line of defense.
Karim reads “Your Bank” as the sender. What must he check first?