Phishing emails don’t work because people are careless. They work because they arrive at 6 PM on a Tuesday, when you’re tired, distracted, and checking your phone with one hand — and they are engineered for exactly that moment. Security analysts consistently find that the majority of successful account breaches begin with a single convincing email.
So instead of giving you abstract rules, let’s do a dissection. Below is a realistic phishing email — a composite of the most common patterns. We’ll go through it line by line, like detectives at a whiteboard.
From: PayPal Security Team <support@paypal-secure-alerts.com> Subject: URGENT: Unusual Sign-In Attempt — Account Will Be Suspended in 24 Hours
Dear Customer,
We detected a sign-in attempt to your account from a new device located in Moscow, Russia. If this was not you, your account will be permanently suspended within 24 hours.
To protect your account, please verify your identity immediately:
[VERIFY MY ACCOUNT NOW]
Thank you for your prompt attention, PayPal Security Department
- 【5-in-1 Hybrid DVR】The expandable hybrid DVR supports up to 16 pcs TVI,AHD,CVI,CVBS & extra 2 IP cameras,so you can choo…
- 【Innovative Human & Vehicle Detection】By setting up the human & vehicle detection, you will get motion detection alerts …
- 【Advanced H.265+ Video Format】H.265+ coding offers longer recording time before having to overwrite the older recordings…
Line 1: “Dear Customer”
Companies you have an account with know your name. A generic greeting is the fingerprint of a mass-blast email sent to a million strangers. Real security emails say “Dear John Smith.” This one says “Dear Whoever Clicks.”
Line 2: The sender address
The display name reads “PayPal Security Team” — but display names are costumes anyone can wear. The actual identity is the domain after the @: paypal-secure-alerts.com. That is not paypal.com. It’s a lookalike domain registered for a few dollars.
How to check: on desktop, click or hover over the sender name — the true address appears. On a phone, tap the sender’s name to expand the details. Make this a reflex: read the domain, not the name.
Line 3: “URGENT… within 24 hours”
This is the weapon. Every phishing email contains a countdown, a threat, or both — because calm people verify things and panicked people click things. Here’s the reality check: banks and payment companies don’t threaten you with clocks. They send letters. They don’t delete accounts in 24 hours over a sign-in. Urgency isn’t a detail of the scam — it IS the scam.
Line 4: Moscow, Russia
- FIREPROOF: Safe is UL Classified to endure 1 hour at 1700°F and keep interior temperatures safe for irreplaceable docume…
- WATERPROOF: Safe is ETL Verified for 24 hours of protection in water up to 8 inches deep offering peace of mind in the e…
- COLOR: The fireproof file box for documents has a black exterior finish
- 5MP SUPER HD & STUNNING NIGHT VISION – Capture crystal clear videos day & night with 5MP super HD cameras. The 18pcs inf…
- SMART PERSON/ANIMAL/VEHICLE DETECTION – The new smart motion detection is now supported by this poe security camera syst…
- PLUG & PLAY POE SYSTEM – With a single network cable, you can connect each IP camera to Reolink NVR for both power suppl…
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before t…
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells yo…
- SECURE CONNECTIONS – Just a few clicks, and your info stays protected on public Wi-Fi every time you connect.
A specific, scary detail. Fear needs a face, so the scammer gives it one. Real notifications do include locations, which is why this works — but note how the detail serves the countdown: act now, the intruder is winning.
Line 5: The button
Display text and destination are two different things. The button says “VERIFY MY ACCOUNT NOW” but where it leads is a cloned PayPal login page — pixel-perfect — waiting to capture whatever you type. (On desktop, hover over any link without clicking and watch the true destination appear in the corner. If the destination doesn’t match the company exactly, it’s a costume.)
Line 6: “Verify your identity”
The entire email exists for this. The goal is always the same: your password, your card number, or a code that was sent to you.
The 10-second scan — four questions:
- Generic greeting, no name?
- Real domain after the @?
- Countdown or threat?
- Am I being asked to click, log in, or “verify”?
Two or more “yes” answers: delete it. And here’s the golden move that beats every phishing email ever written: never log in through a link in an email that alarmed you. Open the app yourself, or type the company’s address yourself. If the alert is real, it will be waiting inside your account too. If it isn’t there — the email was a ghost.
Already clicked? Damage control, in this exact order:
- If you typed a password: change it immediately — on the real site, not from any link. Start with your email account, because email is the master key to every other reset.
- Check where else that password lives. Most people reuse passwords; assume the attackers will try it everywhere. Priority: banking, email, shopping accounts.
- If you entered card details: freeze the card in your banking app — one tap, instant. Report the charge.
- If you downloaded an attachment: disconnect from WiFi and run a full scan — our malware symptom guide includes the free offline scan that catches what’s already running.
- Expect the second act. Verified targets get resold. A “fraud department” may call next week — and no legitimate fraud department on Earth will ever ask you to read out a code or password. That request is the scam announcing itself.
The same anatomy works by text message, too — the “package delivery fee” and “unpaid toll” texts use identical mechanics on a smaller screen. Different costume, same four questions.
You are not paranoid for checking the sender address. You are what the internet calls “someone who doesn’t get phished.”
Affiliate link — “Earns commission at no extra cost to you.
