How to protect yourself from phishing when the fakes look perfect
Most advice still tells you to look for bad spelling and blurry logos. Those clues are fading. Here is what to rely on instead, starting with the habits that protect you even when a fake fools you.
A popular thread on r/CyberAdvice opens with a familiar tip: a lot of phishing sites look convincing until you notice small details like broken formatting and blurry logos. That was good advice for years. It is getting weaker, because a phishing kit copies a real login page exactly, and a language model doesn't make spelling mistakes.
In a 2024 study by Fred Heiding, Bruce Schneier and colleagues, 54% of participants clicked links in fully AI-written spear-phishing emails. That matched emails written by human experts and was far above the 12% for generic phishing. The sample was small (101 people), and a click isn't the same as a stolen account, but the direction is clear. You can't count on spotting the fake.
So the best phishing protection is built around a harder question: what still protects you on the day you are tired, in a hurry and completely fooled?
Clues that have aged badly
| Old advice | Why it fails now | What to do instead |
|---|---|---|
| Look for bad spelling and grammar | AI tools write clean copy in any language | Judge what the message asks you to do |
| Look for blurry logos or broken layouts | Kits copy the real page's images and code | Check the domain, then let software check it too |
| Look for the padlock | It shows the connection is encrypted, not that the site is honest | Ignore it as a sign of trust |
| Hover over the link | Still useful on a computer, but impossible on most phones, and many real emails use tracking links | Go to the site yourself for anything that matters |
| Only trust people you know | Hacked accounts send real messages from real contacts | Confirm unusual requests on a second channel |
We go deeper on this in why phishing pages look so real.
The habits that work even when you're fooled
1. Use a password manager, and treat a failed autofill as an alarm
A password manager fills your password by matching the exact domain. It doesn't care how good the page looks. If you land on rnicrosoft-login.com and it offers nothing, stop. That silence may be the most reliable phishing signal you have, and it needs no judgment from you. Don't search the vault and paste the password in by hand.
2. Move your important accounts to passkeys or a security key
A passkey only works on the site it was created for, so there's nothing useful to type into a fake page. Text-message codes and authenticator app codes are better than nothing, but they can be typed into a phishing page and relayed in real time. Start with your email account, since it can reset everything else. Our guide to phishing-resistant MFA explains the difference.
3. Never sign in from a link you didn't ask for
An email says your bank account is locked. Fine: close the email, open your banking app or a bookmark, and look. If the problem is real, you'll see it there. This one rule defeats most credential phishing, and it works however convincing the message is. Google gives the same advice for its own security emails: don't use the links, check your account activity directly.
4. Confirm money and access requests on a second channel
New bank details, a gift card favor, a password reset request from "IT": call the person on a number you already have, not one from the message. Attackers can control the email thread. It's much harder for them to control the phone in your colleague's pocket.
5. Keep your devices and browser updated
The FTC lists automatic updates first among its protections. It's dull and it works, because a phishing link is only one way in. Some lead to pages that try to exploit an out-of-date browser.
6. Add a check that reads the page for you
Your browser's built-in protection blocks known bad sites. New phishing pages often aren't on those lists yet, so a second layer that looks at the page itself can help: does this page ask for a password and send it somewhere unexpected? Is the address a lookalike of a known brand? That's what PhishClean does, on your device. If you just want to check one address, the free link checker works in any browser, and the phishing email checker reads a suspicious message.
7. Decide now what you'll do if you click
People lose the most in the hour after a mistake, often because they are embarrassed and wait. Clicking usually isn't the disaster. Typing a password or code, or running a file, is what matters. Keep our clicked a phishing link checklist handy. If you're in India and lost money, call 1930 right away.
Five questions to ask about any message
When a message feels off, skip the logo and ask:
- Was I expecting this? An unexpected invoice or delivery problem deserves suspicion.
- What does it want me to do? Sign in, pay, install, scan a code or read out a code are the actions phishing exists to get.
- Why the rush? Deadlines, suspensions and "final notices" are there to stop you from thinking.
- Can I do this without using anything in the message? Almost always, yes.
- Who else can confirm it? A colleague, a bank's number on the back of your card, the company's own app.
For a full walkthrough of the red flags that remain useful, see how to spot a phishing email that looks legit.
Phishing doesn't only arrive by email
The same rules apply to texts, phone calls, QR codes, social media messages, fake CAPTCHAs and calendar invites. A QR code on a parking meter hides its address until you scan it. A page that tells you to press Win+R and paste a command is trying to get you to run the attack yourself. A caller who says "I'll just need the code we sent you" is phishing in real time. Don't give anyone a one-time code, however official they sound.
If you only do three things
- Install a password manager and stop typing passwords by hand.
- Turn on a passkey or security key for your main email account.
- Go to important sites yourself, never through a link you didn't ask for.
Frequently asked questions
What is the best way to protect yourself from phishing?
Use a password manager, turn on passkeys or a security key for your email and other key accounts, and go to important sites yourself rather than through links in messages. These work even when a fake is too good to spot.
Can you still spot phishing by bad spelling or blurry logos?
Sometimes, but it is no longer reliable. Phishing kits copy real pages and AI tools write clean text. Treat a mistake as a warning sign, but don't treat a polished message as proof that it's safe.
Does the padlock mean a website is safe?
No. The padlock means your connection to the site is encrypted. Phishing sites can get certificates too, so it says nothing about whether the site is honest.
What should I do if I clicked a phishing link?
Don't panic. If you only clicked, close the page. If you typed a password, change it from a trusted device and sign out other sessions. If you entered card details, call your bank. If you downloaded and ran a file, disconnect the computer and scan it.
Sources
- Heiding, Lermen, Kao, Schneier and Vishwanath: AI-automated spear phishing study (arXiv 2412.00586) (54% vs 12% click-through, 101 participants)
- FTC: How to recognize and avoid phishing scams
- Google: Avoid and report phishing emails
- NIST SP 800-63B-4 (manual entry and OTP aren't phishing-resistant)
Add a check that doesn't get tired
PhishClean reads the page you're on and warns about fake sign-ins, on your device. Zero browsing data collected. Ever.
Install PhishClean freeLast updated: