Ask our technicians what actually infects most computers and you'll get an answer that surprises people: not Hollywood hackers — email. One convincing message and one hurried click. The good news is that phishing emails almost always fail the same six checks. Run this 60-second drill before you click anything.
Check 1: The real sender address
Display names mean nothing — 'Microsoft Support' can be typed by anyone. Click or tap the sender's name to reveal the actual address. Genuine PayPal mail comes from paypal.com, not paypal-secure-center.net. If the domain has extra words, hyphens or a strange ending, stop there.
Check 2: Where the link really goes
Hover your mouse over any button or link (long-press on a phone) and read the preview of the true destination. A 'Track your package' button pointing to a site you've never heard of is the whole scam, visible before you click.
Check 3: Manufactured urgency
'Your account will be suspended in 24 hours.' 'Unusual sign-in — verify now.' Urgency is the phisher's only real tool, because it stops you doing checks 1 and 2. Genuine companies give you weeks, not hours — and never punish you for calling them directly.
Check 4: How it greets you
Your bank knows your name and uses it. 'Dear Customer' or 'Dear valued user' on a message claiming to be about YOUR account is a tell. It's not proof on its own — but combined with anything else on this list, it's decisive.
Check 5: Unexpected attachments
Invoices you weren't expecting, 'scanned documents' from a printer you don't own, .zip or .html attachments of any kind — don't open them to 'see what they are'. What they are is the infection. When in doubt, reply to the sender's known address or phone them and ask.
Check 6: The gut test
Refunds you didn't request, passwords expiring a year early, a CEO who suddenly emails with an urgent payment — if a message feels slightly off, it is off. Verify through a channel you already trust: the official app, the saved phone number, the website you type yourself.
Make the drill automatic
- Turn on multi-factor authentication for email and banking — it defeats most phishing even after a click.
- Keep your browser and OS updated so known malicious sites get blocked.
- Use a password manager: it refuses to autofill on lookalike domains, which is a built-in alarm.
- Report the message as phishing in your mail app — it trains the filter for everyone.
Clicked something you shouldn't have? Book a $59 remote support session — we'll check for compromise, secure your accounts and set up protection so it can't happen twice.
Related service
Antivirus Installation, Consultation & Removal · $69 flat
Honest advice on the right antivirus for you — plus clean install, configuration and safe removal of unwanted security software.
Book this service