Phishing continues to dominate the cybercrime landscape and remains a major problem for organizations and individuals alike. The goal of many phishing attacks is to persuade the victim to click on a link, which could download malicious software or lead to a website built to harvest credentials and other personal information. This page will outline some phishing red flags to help you avoid becoming the victim of these attacks.

Hover over links

To see where a link is really directing you, hover your mouse over the link but do not click. This will cause the destination to appear in the bottom left corner of your screen, allowing you to determine the legitimacy of the link.

Does the domain match the content of the message?

If the domain of the link does not match the official domain of the company, it is a fraudulent link. An example of this would be receiving an email claiming to be from your bank, and the corresponding link is unrelated to your bank.

Watch out for spoofed domains

In many cases, phishers will attempt to emulate, or “spoof” real domains. Watch out for misspellings or extra periods within a link, as those will direct you to a fraudulent site. Examples of this would be ‘www.anazon.com’ or ‘www.wus.tl.edu’. These differences can be difficult to spot, so be sure to examine links closely for such errors.

Use a hyperlink extender website or extension

It can often be difficult to view links using the hover-over method, and even more difficult to determine legitimacy if it is a spoofed domain. A hyperlink extender allows you to copy and paste a link, and it will display the full link to avoid deception and to check for a spoofed link. Use a hyperlink extender either through a browser extension or a website to better determine the legitimacy of a link.

Verify the sender’s email address

In Outlook for mobile, the email address is not displayed by default. You can verify the sender’s email address by first opening the email and then tapping on the displayed name.


For more information on phishing attacks, please visit our phishing page.