How a phishing message works

Module 3: Recognising phishing · Reading time: 11 minutes

Learning objective: After this lesson, you can recognise the psychological tricks and fixed features of a phishing message, even when the text is flawless, and you respond with the reflex stop, check, ask.
Key terms: urgency, authority, fear, curiosity, reward, pretext, AI-written phishing, the "stop, check, ask" reflex

Phishing is a story, not a technology

Phishing is a message that gets you to do something that's good for the sender and bad for you: clicking a link, logging in on a fake page, opening an attachment, making a payment or passing on a code. The technology behind it is often simple. What does the work is the story.

That story is called a pretext: a credible reason. "Your parcel couldn't be delivered." "Your mailbox is full." "You have an outstanding invoice." "Your account will be blocked." A good pretext fits your situation. A bakery gets an email about a flour supplier, a law firm about a summons, a webshop about a blocked payment.

The goal is almost always one of these four:

With the last type, nothing bad happens at the time itself. "Who handles payments at your company?" looks like an ordinary question. But with the answer, the attacker can later send a much more convincing email, targeted at that one person. This is called spear phishing (lesson 1.2).

The five buttons phishing presses

Phishing works because it gets you to act before you think. To do that, it presses a few fixed buttons in our heads. Almost every phishing message uses at least two.

1. Urgency. "Within 24 hours", "today", "final reminder". Time pressure is the most important trick, because it stops you taking the time to check.
2. Authority. The message supposedly comes from someone you take seriously: the bank, the tax authority, the managing director, the police, your hosting provider, a solicitor.
3. Fear. Your account will be blocked, you'll get a fine, your data has been leaked, your domain is expiring, there's been a break-in on your account.
4. Curiosity. "View the photos from the event", "you've received a shared document", "you have a voicemail", "salary overview 2026.pdf".
5. Reward. A refund, a gift voucher, a prize you've won, a free upgrade, a large order from a new customer.

Note: these buttons also appear in genuine messages. A real invoice has a due date, a real bank sometimes sends a warning. So one trick alone doesn't make a message fake. It becomes suspicious when the pressure is high and the message asks for something you wouldn't normally do.

Fixed features, regardless of the text

Besides the tricks, phishing messages have a few features that almost always recur:

• An instruction to act now (call to action): a button, a link, an attachment, a phone number to call.
• A channel that doesn't fit. Your bank asks by email to log in, your supplier asks via WhatsApp for a payment, your colleague asks via text message for gift vouchers.
• A request that doesn't fit. Passing on a password or login code, changing an IBAN, a payment outside the normal procedure, installing software at a caller's request.
• A mismatch in the sender or link. The address or link is just slightly off from the organisation you'd expect. You'll learn exactly how to spot that in lessons 3.2 and 3.3.
• Secrecy or bypassing the procedure. "Don't mention this to anyone yet", "I'm in a meeting, don't call me", "just do it outside the system for now".

The last feature is the strongest signal in CEO fraud and invoice fraud: a genuine director has no interest in you skipping the normal checks.

Why spelling mistakes are no longer a reliable feature

In the past, you could recognise phishing by clumsy language, odd greetings and ugly formatting. That no longer works. With language models (AI), an attacker can write a flawless, friendly email in seconds, in any language, in the style of the organisation they're impersonating. The NCSC also warns that AI is making phishing harder to recognise: fewer language mistakes and login pages that look increasingly authentic.

On top of that, phishing sometimes comes from a genuine mailbox. If a supplier's mailbox has been taken over, the attacker simply replies within an existing email thread, complete with the signature, the tone and the earlier messages. This is called thread hijacking. The sender, formatting and language are all genuine. Only the request is wrong: "We have a new bank account, could you pay the outstanding invoice to that one instead?"

That's why you shouldn't look at how a message looks, but at what it's asking of you. You rarely recognise phishing from one single feature, but from the overall picture.

The reflex: stop, check, ask

You don't need to know every trick. You need one reflex that you use every time a message asks something of you.

Stop. Do you feel rushed, alarmed, curious or pleased? That's exactly the moment not to click. Put the message aside for a moment. Genuine organisations almost always give you enough time to check things.

Check via your own route. Don't continue via the message itself. Don't click the link, don't call the number in the message and don't reply to the email. Go to the site yourself via your bookmark or by typing the address, or call a number you already had (your own records, the back of your bank card, the official site). Is the invoice really there? Is the parcel really on its way?

Ask. If you're still unsure, ask a colleague or the person who supposedly sent it, via a different channel. Agree within your team that this kind of question is never a bother. Better to ask ten times unnecessarily than to pay once wrongly.

This reflex also works with a perfect email from a hacked mailbox. Checking via your own route bypasses the attacker entirely, because they're not in your bookmarks and not on your supplier's phone line.

In practice: what it looks like

Three simulated messages that Bakkerij Example (info@example.com) receives in one morning. All names are made up.

Message 1: the parcel

From: Courier Service <service@koeriersdienst-track.example>
Subject: Delivery failed: action required
Dear customer, we tried to deliver a parcel today. The address was incomplete. Schedule a new delivery within 48 hours and pay the redelivery fee of 1.95 euros, otherwise the parcel will be returned to the sender.

Tricks: urgency (48 hours), fear (parcel returned), a small amount so you don't think twice. The goal is your card details. Check: are you expecting a parcel? Look up the shipment via the carrier's own site or app.

Message 2: the supplier

From: Flour Supplier <administratie@leverancier.example>
Subject: RE: invoice 2026-0412
Hi, here's the invoice as discussed. Please note: due to a change of bank, please pay to our new account number from now on. Could you do that today? Then we can schedule Friday's delivery.

Tricks: authority (known supplier, existing email thread), urgency, reward (the delivery). The sender could be genuine: the supplier's mailbox may have been taken over. Check: call the supplier on the number from your own records, not from this email.

Message 3: the accounting software

From: Accounting Software <noreply@boekhoudpakket.example>
Subject: Your subscription will be suspended
We couldn't process your last payment. Log in within 24 hours to update your payment details, otherwise you'll lose access to your records.
[Sign In]

Tricks: fear, urgency, authority. Whether the sender is genuine, you'll read in lesson 3.3; where the button leads in lesson 3.2. Check: open the accounting software's app or your bookmark yourself. If there's no notification there, the email is fake.

Summary

• Phishing works through a story (pretext) that fits you, aiming for login credentials, money, access to your device or information.
• The five buttons: urgency, authority, fear, curiosity and reward. Usually it's two or more at once.
• Spelling mistakes are no longer a reliable feature: AI writes flawless emails and hacked mailboxes send genuine messages.
• Look at what a message is asking of you and through which channel, not at how it looks.
• Reflex: stop, check via your own route, ask if in doubt.

Quiz

Exercise

Exercise A3.1: Recognising tricks. You're given six simulated messages. For each message, choose which tricks it contains (urgency, authority, fear, curiosity, reward) and what to do: just deal with it, or check via your own route first. The programme checks your answers and explains per message what you've missed.

Further reading

The steps in the WebOké articles apply to the WebOké environment; with other providers it works in a similar way.

• Is this email really from WebOké? Recognizing phishing and using the promo code
• NCSC, How do I recognise a phishing email?: https://www.ncsc.nl/phishing/hoe-herken-ik-een-phishing-e-mail
• NCSC, Phishing: https://www.ncsc.nl/wat-kun-je-zelf-doen/dreiging/phishing
• Fraud Helpdesk, for reporting fraud and phishing: https://www.fraudehelpdesk.nl