As of Oct. 9, 2026, the National Cybersecurity Alliance and Tech Times say unexpected invoices or payment requests are a common phishing indicator and recommend verifying them through independent channels.
Asking for payment via gift cards, wire transfers, cryptocurrency, or courier‑delivered cash is a strong indicator of a phishing scam. Urgent messages that say an account will be locked, demand quick action to avoid penalties, or threaten investigation are common phishing tactics.
If an email shows a bank‑branded QR code, it is safer to go to the bank’s website or open its app instead of scanning the code. Microsoft Defender notes that quishing (QR‑code phishing) attacks have increased, with their share of phishing attempts climbing from 10% to 30% and QR‑code phishing up 25% year over year. Quishing can bypass multifactor authentication by sending victims to fake sites where they input login details, letting attackers steal passwords and session tokens.
Using a generic greeting such as ‘Dear Customer’ instead of the recipient’s name often signals a mass‑phishing email, and sender addresses with small typos or unusual domains also raise suspicion. Moving the cursor over a link shows the actual URL, helping to spot harmful destinations, and unexpected attachments should not be opened unless they are verified as safe through another channel. Clumsy wording, uneven layout, or bad grammar can hint at phishing, even when AI‑produced text looks smooth.
If you click a doubtful phishing link, disconnect from the internet, change passwords, run a security scan, turn on multifactor authentication, alert your bank if you shared data, and watch your accounts for odd activity.
Join the discussion