Phishing: how to spot it before you click

The six signs

1. Urgency or pressure: "within 24 hours", "account suspended", "invoice overdue". Hurry is the attacker's best ally.
2. The sender does not add up: the displayed name is right, but the real address is different or the domain is almost identical (rn instead of m, an extra letter, another extension).
3. Links that go elsewhere: hover over the link (or long-press on the phone) and read the real destination before clicking.
4. Unexpected attachments: compressed files, documents asking to "enable content", HTML pages or invoices you were not expecting.
5. Requests for credentials or payments: a login page to "verify" the account or a supplier asking to change the IBAN. Always verify by phone, using a number you already know.
6. Generic tone: "Dear customer" instead of your name. Careful, though: with AI, phishing emails are now often flawless, so correct Italian or English is no longer a guarantee.

What to do

• Do not click and do not reply: report the email to IT or to whoever manages security.
• If you have already clicked or entered a password: change it immediately and report it straight away. Speed matters more than embarrassment.
• Turn on multi-factor authentication: even if a password is stolen, it greatly reduces the damage.