The seven red flags
- Urgency and threats — "act now or your account is closed."
- Mismatched sender — display name vs. actual address.
- Generic greetings where a real sender would use your name.
- Unexpected attachments, especially documents asking you to enable content.
- Links that don't match — hover to see the true destination.
- Requests for credentials or payment changes.
- Subtle misspellings in domains and brand names.
Make it a habit
When in doubt, don't click — verify through a known channel. Print this list for the break room and reinforce it with periodic security awareness training.