Spot the signs of the scam, one by one.
A 12–15 minute lesson: the analyst board's ten signals, the real weight of each one, and the pattern that gives them away when combined.
Which signals give away a phish, how much each one weighs, and how to combine them to decide without panic.
The case
The impostor looks flawless: perfect logo, right tone. The trap lives in the signals almost nobody reads.
In 12–15 minutes you'll build your board: ten signals, the weight of each one, and the pattern that gives them away when they combine.
What you will learn
- Spot the strong signals: sender and link
- Weigh each signal without panicking over props
- Pull the pattern together and issue a grounded verdict
The analyst's board
No single signal condemns alone: pull threads between three or more and the pattern shows itself.
Sender
Who's really talking.
Signals
Ten cards, one board.
Pattern
Three taut threads = a case.
Verdict
Decide, don't guess.
Frequently asked questions
Which phishing signal is the most reliable?
The one the attacker can't fully disguise: the sender's real domain and the link's real destination. The rest — logo, design, HTTPS — is props.
Is one signal enough to delete an email?
No: a lone signal is noise. Pull threads between several before deciding — though if the domain is fake, the case practically closes itself.
Test yourself: Lightning test: signal or noise?
Is one isolated signal enough to condemn a message?
Correct answer: No: the pattern is born from combination. A lone signal is noise.
One card doesn't make a case: the analyst pulls threads between several before issuing a verdict.
The email uses your real name and the bank's logo is perfect. What does that mean?
Correct answer: Nothing by itself: personalization and design are already attacker tools.
Real name and flawless logo are professional props. What can't be fully disguised: the real domain and the real destination.
The sender says “Banco Central” but the address is soporte@bancocentra1.com. What do you read?
Correct answer: Fake domain: the camouflaged “1” isn't bancocentral — the sender condemns.
What's displayed (“Banco Central”) is a prop; what weighs is the real address. The domain is one of the few signals that condemns almost alone.
The pocket rule — No signal condemns alone: sender and link are the strong ones; urgency and generic greetings only weigh in company; logo and HTTPS are props.
What you take away
Analyze a suspicious message signal by signal and decide whether it deserves your trust.