Phishing Targets Urgency
What do almost all of these messages have in common?
The idea
Phishing works by creating time pressure so the recipient acts before verifying.
In the real world
An email claiming an account closes in one hour unless details are confirmed.
Going deeper
Phishing works by compressing the time available to verify. The urgency is not incidental decoration; it is the mechanism, because a recipient who pauses will usually check and the attack fails.
This gives a defence that does not require spotting fakes, which is increasingly difficult. A standing rule that anything urgent gets verified through a channel you chose — typing the address yourself, calling a number you already had — defeats the attack whether or not the message is convincing. Refusing to be hurried is the whole of it.
Where it stops applying
Genuine urgent messages exist, and the rule costs a few minutes on those. That is a small price against a class of attack that scales indefinitely.
Why it matters
It gives you one reliable trigger to watch for, rather than trying to spot every fake.
Try this today
Adopt a rule: anything urgent gets verified through a channel you chose.
Test yourself
A convincing email says an account will be suspended within the hour. What is the single most reliable response, without inspecting the sender at all?
Show the answer
Stop and reach the organisation through a route you already know, such as typing the address yourself. Urgency exists to prevent that step, so refusing to be hurried defeats the attack whether or not you can tell the message is fake.
Learn this in the feed Answering from memory, then again days later, is what makes it stick.