Originally published August 2024 · Updated November 2026.
Phishing is not only common, it is changing. Attackers have moved away from the misspellings, poor URL obfuscation, and obviously malicious attachments of the past. Resisting phishing now depends on safe habits and on understanding the context of a message.
As a Senior Offensive Security Consultant at Echelon Risk + Cyber, I have run modern phishing campaigns with a high rate of success. The three strategies below come from the techniques we use in those real campaigns.
How can you tell whether a link in an email is malicious?
Inspect links with technical controls, and train users to be skeptical. Check the legitimacy of the domain, its reputation, whether it hosts malware, and how recently it was registered. The safest habit is to go to the site directly instead of clicking the link.
Train users to recognize the common techniques attackers use to get a click:
Tactic 1: The fake breach alert
Users get an email saying their bank account has been breached and they need to log in to verify their identity. Train them to go to the site separately and handle “breaches” or other time-sensitive events (if they are real) from there, not from a link in an “urgent” email.
Tactic 2: Lookalike characters
The words “apple” and “appIe” look the same, but the second uses a capital “I” instead of a lowercase “l”. Attackers can disguise a malicious link this way and defeat a visual URL check. Remind users that links cannot be trusted just because they look right, and that going to a site directly is always safer than following a link in an email.
Tactic 3: Masked links
Modern attackers often do not link straight to their malicious site. They use a mail delivery service to mask the link, which makes it harder to verify without visiting the site yourself. Again, train users to go to sites directly rather than follow links.
Why should you be skeptical of urgent emails?
Train users to be skeptical of time-sensitive, urgent emails, especially ones that include links or attachments. Attackers rely on your sense of urgency to make you act fast and forget your training. When a company needs you to act, it will typically tell you to log in manually and will not put a link in the notification email.
How do attackers get around multi-factor authentication (MFA)?
Make sure users do not accept MFA requests they did not initiate. An attacker who compromises a user’s credentials still needs that user’s approval to log in, but users often tap “accept” on every request, which bypasses the protection. In our engagements, that technique has worked countless times, leaving us able to log in with a single factor.
We recommend token-based MFA, where the user types the second factor from their phone or another hardware device instead of approving a prompt.
Update: typed one-time codes remove the “tap accept” habit, but a convincing fake login page can still capture them. Phishing-resistant methods, such as FIDO2 security keys or passkeys, tie authentication to the real site. Consider them first for administrators and other high-value accounts.
The bottom line
As techniques advance, user awareness has to advance with them. When a phishing email can be visually indistinguishable from a legitimate one, context and safe practices are the key.
FAQs
What is phishing?
Phishing is a social engineering attack in which an attacker poses as a trusted sender, by email, text, or phone, to get someone to click a link, open an attachment, or hand over credentials. It is the most reported internet crime type in the FBI’s annual reports.
How can employees spot a phishing email today?
Do not rely on typos or obvious attachments, because modern attacks avoid them. Look at context: an unexpected request, a sense of urgency, or a link asking you to log in. Instead of clicking, go to the site directly and handle the issue from there.
What is a lookalike character attack?
Attackers swap characters that look alike, such as a capital “I” for a lowercase “l”, so a malicious web address passes a visual check. Because links cannot be trusted on appearance alone, it is safer to type the address or use a saved bookmark.
Why do users accept unexpected MFA requests, and how do you stop it?
Users often tap “accept” on every prompt, which lets an attacker with stolen credentials in. Train users to deny requests they did not start. Typed codes help, and phishing-resistant methods such as security keys or passkeys are stronger still.
Should I click a link in an urgent email from my bank?
No. Go to the bank’s site directly and handle the issue there. Legitimate companies typically tell you to log in manually and do not include links in urgent notifications.