Verify the Request, Not the Feeling

The concept

A phishing message tries to make someone disclose information, open a dangerous item, or authorize an action by impersonating a trusted party. Good spelling and familiar branding are weak evidence of legitimacy. Focus on the requested action and verify it through a channel you already trust, especially when urgency or secrecy is involved.

Worked example

A fictional treasurer receives a polished message claiming the club president needs an immediate payment to a new vendor. The display name and writing style seem familiar. Instead of replying or using the supplied phone number, the treasurer calls the president using the number in the existing directory. The president confirms there was no request. The treasurer preserves and reports the message through the organization's established process.

Limits and judgment

Verification should be proportionate and practical. Not every unexpected email is malicious, and routine suspicion without a usable workflow can cause people to ignore guidance. Create clear rules for sensitive changes such as new payment details, account recovery, and data exports. A separate check can catch both external impersonation and a request sent from a genuinely compromised account.

RETRIEVE. REASON. REMEMBER.

Knowledge check.

Choose one answer for each question, then check your reasoning.