Phishing is the oldest trick on the internet, and it still works because it keeps getting better. The clumsy “Dear Customer” email full of typos was easy to laugh at. The 2026 version is clean, well designed, mentions your actual recent activity, and lands at a believable time of day. This is a plain-language guide to how to avoid phishing in 2026 without turning into someone who flinches at every email they open.
What phishing actually is
Phishing means getting you to hand over something valuable — usually a password or a payment — by pretending to be someone you trust. That trust signal used to be a logo and a faked sender name. Now it is often a personalized story about you, stitched together from data pulled out of a breached database somewhere. The goal has not changed. The bait just got sharper.
How to avoid phishing: the five cues that still work
You do not need fifty red flags. A small handful do most of the work.
1. The sender domain is almost right
Check the part after the @. Real PayPal mail ends in paypal.com. A phish might use paypal-security.com or secure-paypal.net — close, but not PayPal. When you want to be certain who really sent a message, you can read the technical trail yourself; I walk through that in how to spot a spoofed sender in the email headers.
2. The link goes somewhere it should not
Hover over any link before clicking; most clients show the real destination at the bottom of the screen. If a “bank” email points to a Google Docs URL, a Bitly link, or a domain you have never seen, do not click. On a phone, long-press to get the same preview.
3. The message manufactures urgency
“Your account will be suspended in 24 hours.” “Confirm delivery within 2 hours.” Real companies rarely talk like that. Urgency exists to stop you thinking. The moment an email rushes you, slow down and verify another way.
4. The request does not match the channel
Your bank will not ask for your full password by email. A courier does not collect “redelivery fees” by SMS. If the real sender would never ask for that thing in that channel, treat it as phishing by default.
5. The login page looks right but the URL is wrong
This is the one that catches careful people. You click, you see a pixel-perfect copy of your bank login, you type your password, nothing happens — because it was a clone on a different domain. Before you ever type a password, glance at the address bar. The domain should be exactly the one you expect and nothing else.
The newer tricks worth knowing
AI-personalized messages
Attackers now use language models to write mail that references a real conference you attended or a real parcel you are waiting on, usually from breached or scraped data. An email knowing something about you does not prove it is genuine. It only proves the data is out there.
Lookalike domains with Unicode
A domain can look like microsoft.com while using a non-Latin character that mimics a letter. It survives a glance and fails a careful look. Paste a suspicious URL into a plain text editor and the odd characters usually jump out.
Calendar and file-share phishing
It does not always arrive as email. A calendar invite from a stranger can carry a malicious link; a file “shared” through a real service can lead to a fake login. Same caution applies to any unexpected invite or document.
QR-code phishing
Posters, parking meters, and restaurant tables have all been used to plant QR codes that open fake payment pages. If scanning a code lands you on a payment form, check the domain before you type a thing.
The two habits that beat almost everything
If you keep only two things from this guide, keep these.
Verify out of band. If a message claims to be from a service you use, do not click its link. Open a fresh tab, type the address yourself, and log in there. A real problem will be waiting on the dashboard.
Use a password manager plus two-factor authentication. A password manager refuses to autofill on a fake domain — one of the strongest anti-phishing defenses going — and it also kills the password-reuse habit that turns one breach into ten. Pair it with two-factor authentication (an app or hardware key, not SMS) so that even a successful phish does not hand over the account.
Reduce your exposure in the first place
Phishing reaches you because someone, somewhere, has your address. Fewer places holding your real email means fewer places that can leak it. This is the part I care about most, because it is basically why I built LettMail: using a temporary email for low-trust sign-ups keeps your real address out of the databases that get breached. If a leak three years from now exposes a disposable address, the attacker gets nothing — it stopped existing long ago.
If you think you clicked
Mistakes happen, and the right response is calm and fast. Change the password on the affected account from a different device. Sign out of all sessions in the settings. Confirm two-factor authentication is still on and still tied to a device you hold. Check recent login activity, and if anything looks unfamiliar, treat it like a breach — here is exactly what to do in the first 24 hours. You can also report the message to the FTC.
Phishing wins on inattention, not on intelligence. You do not have to outsmart every scam in your inbox. You need a few habits that take the urgency out of the moment, plus a couple of tools that catch whatever slips through.