How to spot and avoid phishing in 2026

Phishing used to be easy to spot. Bad grammar, a weird domain, a prince who needed your bank details. That version is mostly gone. What’s replaced it is emails written by large language models that read exactly like your bank, deepfake voice calls that sound exactly like your boss, and video calls where the face on screen is generated in real time. In February 2024, a finance employee at the engineering firm Arup wired out roughly $25 million after a video conference call with people who looked and sounded like the company’s CFO and colleagues. None of them were real. That’s the bar now, not a spam email with three exclamation points.

This tutorial is for anyone managing their own logins, running a small business, or helping family members who aren’t going to read a security blog on their own. I’m writing it from an operator’s seat, I run several sites and manage dozens of accounts and infrastructure logins myself, so this is the actual checklist I use, not a theoretical one.

By the end you’ll have a repeatable process for checking incoming messages and calls, a short list of tools that cost little or nothing, and a plan for what changes as you go from protecting yourself to protecting a team.

what you need

a password manager: Bitwarden (free tier is genuinely usable) or 1Password (about $36/year for individuals)
an authenticator app or passkey support on your phone (built into iOS and Android already, no cost)
optionally a hardware security key like a YubiKey (roughly $25-55 depending on model) for your most sensitive accounts
10 minutes to check your email addresses against Have I Been Pwned
a browser with phishing protection turned on (Chrome and Edge have Safe Browsing, Firefox has Enhanced Protection, both are on by default but worth confirming)
the discipline to pause before clicking, this is free but it’s the part people skip

step by step

Enable passkeys or a hardware key on the accounts that would hurt most if lost: your primary email, your password manager, your bank if it supports it, and whatever you use for work SSO. Passkeys are already built into Google, Apple, and Microsoft account settings.

Expected output: your next login prompts Face ID, Touch ID, or Windows Hello instead of typing a password.

if it breaks: not every bank supports passkeys yet. Fall back to an authenticator app generating a 6-digit code (Google Authenticator, Authy, or your password manager’s built-in TOTP), not SMS. The CISA guidance on multi-factor authentication explains why SMS codes are the weakest option, they can be intercepted through SIM swapping.

2. set up a password manager and kill reused passwords

Install Bitwarden or 1Password, import your existing passwords from your browser, then run the manager’s built-in weak or reused password report.

Expected output: a report showing zero passwords reused across more than one site.

if it breaks: some old sites have custom login forms that block autofill. Don’t skip updating those accounts, just copy-paste the generated password manually.

3. check your breach exposure

Go to haveibeenpwned.com and enter every email address you actively use.

Expected output: a list of breaches that exposed that address, or a clean result.

if it breaks: if an old breach shows your password was leaked in plaintext, and you’ve reused that password anywhere since, change it everywhere immediately, don’t wait for a “convenient” time.

4. learn to read the sender, not the display name

Phishing emails now often spoof a display name (“PayPal Support”) while the actual address is unrelated. Tap or click to expand the full sender address. If something still looks off, check the message headers for authentication results.

Authentication-Results: mx.google.com;
       dkim=pass [email protected];
       spf=pass smtp.mailfrom=theprivacywire.com;
       dmarc=pass header.from=theprivacywire.com

Expected output: dkim=pass, spf=pass, and dmarc=pass, all aligned to the domain the email claims to be from.

if it breaks: dmarc=fail, or a from-domain that’s close but wrong (theprivacywlre.com instead of theprivacywire.com, paypa1.com instead of paypal.com) means treat it as phishing and don’t click anything in it.

5. verify links before clicking

Hover over a link on desktop or long-press it on mobile to preview the actual destination URL before tapping.

Expected output: the preview shows a domain that matches the company’s real domain, not a lookalike.

if it breaks: shortened links (bit.ly, t.co) hide the real destination entirely. Either skip the shortener with a tool like unshorten.it, or safer, just navigate to the company’s site directly by typing the address yourself instead of clicking.

6. treat unexpected voice or video calls as unverified

If you get a call, video call, or voice message from “your bank,” “your boss,” or a family member asking for money, codes, or credentials, that’s the highest-risk scenario in 2026 because voice cloning tools now need only a few seconds of sample audio. Hang up and call back on a number you already have saved, not one provided in the call or message.

Expected output: you’ve confirmed the request through a channel the scammer doesn’t control.

if it breaks: caller ID spoofing means the number on your screen can look legitimate even when it isn’t. That’s exactly why the callback has to go to a number you saved previously, not one they just gave you.

7. report and quarantine, don’t just delete

Use your email client’s built-in “report phishing” button (Gmail and Outlook both have one) or forward the message to [email protected], the Anti-Phishing Working Group’s shared inbox, then block the sender.

Expected output: the message moves to spam and, in a workplace, your IT or security team gets a copy.

if it breaks: nothing changes instantly. Filter improvements from reports happen over weeks across the whole email ecosystem, not in the next five minutes for you personally. That’s normal, keep reporting anyway.

In your Google, Microsoft, and banking app settings, set a recovery phone or email that isn’t your primary inbox, and turn on new sign-in or new device alerts.

Expected output: you get a notification within minutes of a login from an unfamiliar device or location.

if it breaks: too many alerts from your own new devices causes alert fatigue. Mark trusted devices as trusted, but keep location-based and browser-based alerts on, that’s the signal that actually matters.

common pitfalls

trusting caller ID or a display name at face value. Both are trivially spoofed. The actual email address or a callback to a known number is the only thing worth trusting.
using SMS as your only second factor. SIM swapping is a known attack against exactly this, use an authenticator app or passkey instead where the service allows it.
clicking “unsubscribe” on a suspicious email. On real spam this is fine, but on phishing it can confirm your address is active and lead to more targeting, or land on a fake page. If you don’t recognize the sender, block and report instead.
assuming your phone is safer than your laptop. Mobile phishing (smishing) via text and messaging apps has grown specifically because people are less careful on small screens where full URLs don’t show.
one password manager, one master password, no backup. If you forget it and haven’t saved your emergency recovery kit somewhere offline, you can lock yourself out of everything at once. Print the recovery sheet your password manager generates and store it somewhere physical.

scaling this

protecting yourself and immediate family (roughly 5-10 accounts): get everyone on the same password manager under a family plan, and walk parents or less technical relatives through steps 1-3 in person once. The habit matters more than the tool.

protecting a small team or business (10-100 people): individual discipline stops being enough. You need domain-level email authentication, SPF, DKIM, and DMARC configured for your own sending domain, so your customers can verify mail actually came from you. Run periodic simulated phishing tests so people build the pause-before-clicking habit under low stakes. Enforce MFA at the admin level rather than asking people to opt in.

protecting an organization (100-1000+ people): this becomes a full security program. Single sign-on with conditional access policies, DMARC set to reject rather than just monitor, a dedicated security awareness platform, and actual incident response procedures for when someone does click. At this scale the cost of one convincing deepfake call to a finance team, like the Arup case, is high enough that voice/video verification protocols for wire transfers need to be a written policy, not a personal habit.

where to go next

Once your accounts are locked down against phishing, the natural next steps are checking whether your data is already exposed and hardening the accounts attackers go after first. Read how to check if your accounts were in a breach and how to lock down your Google account next. If you also want your home network hardened against the same class of attacker, how to secure your home network in 2026 covers that. More guides like these live on the blog index.

If you’re curious how convincing AI-generated phishing content and deepfake tools have gotten, and want to see the underlying tools reviewed rather than take my word for it, I’ve covered several of them at AI Tool Gazette.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-07-22.