The most dangerous email you'll get this year probably won't come from a stranger. It'll come from your sister, your coworker, or your oldest friend, from their real email address, with a potential friendly note and a link.
That's why the old advice to "ignore emails from people you don't know" no longer protects you. Here's how modern attacks actually work, how to see through them, and what to do if you've already clicked.
The Email From Mom That Wasn't Mom
Hackers love compromised email accounts because trust transfers automatically. Once they steal one person's login (to their email account), they get access to that person's entire contact list, along with a reputation that makes every message look legitimate.
The attack usually unfolds like this:
Someone you know gets phished. They enter their password on a fake login page. Their login information is stolen by a scammer / hacker.
The attacker logs in quietly. They often set up a hidden forwarding rule so they keep receiving copies of messages even after a password change. They are sneaky and usually attempt to secure access to the accounts they have hacked.
They email the victim's contacts. Common messages include "Here's the document I mentioned," "Can you look at these photos?" or a shared file that appears to come from Google Drive, Dropbox, DocuSign, or Microsoft 365. Their goal is to get you to click a link in the email.
The link leads to another fake login page. Each new victim feeds the cycle. Hackers will spoof login pages that resemble known services like Google, Yahoo, Facebook etc.
The sender's address is real. The danger lives entirely in the link.
How a Fake Login Page Actually Steals Your Password
The phishing site is a near-perfect copy of a real service. Same logo, same colors, same layout. The difference is where your typing goes; your login information submitted doesn't go to where you think it's going.
When you enter your email and password on a fake Google page, here's the sequence:
Your credentials get sent to the attacker's server, not Google's.
The site then redirects you to the real website, often logging you in automatically or showing a normal "session expired" message. Stored cookies in the browser might allow automatic login after hacker redirects your browser to the real service.
Because the real site loads and sets its usual browser cookies, nothing seems wrong. You feel like you logged in successfully.
Advanced kits go further by relaying your login to the real service in real time, capturing the session cookie and the two-factor code as you enter it. The attacker then rides that stolen session straight into your account.
The whole thing takes seconds, and most victims never notice a thing.
The Link Text Is a Lie (And Here's Why)
This is the single most important technical fact for spotting phishing: the visible text of a link has nothing to do with where it goes.
In HTML (the code that makes websites), a link is written with an anchor tag. The part you see on screen and the part your browser actually visits are two separate pieces:
The text might read "
https://accounts.google.com"The real destination could be
https://g00gle-verify-login.ru/signin (Notice the suspicious domain/URL)
The words are just a label. An attacker can make a link say anything while pointing it anywhere. So reading the blue underlined text tells you nothing.
How to Check Where a Link Really Goes
On a desktop or laptop:
Hover your mouse over the link without clicking. The real destination appears in the status bar at the bottom-left of your browser.
If it's an email client, hover works the same way. Watch for the true URL popping up.
On a phone or tablet:
Press and hold the link (don't tap). A preview menu appears showing the full URL before you commit.
Read it carefully before choosing anything.
Reading the Domain Correctly
Scammers bury the fake part inside a long, confusing address. Focus only on the core domain, which is the part right before the first single slash.
accounts.google.com.verify-login.netis not Google. The real domain isverify-login.net. (verify-login.net domain name can easily be registered and owned by attackers)secure-paypal.comis not PayPal.Watch for lookalike characters:
rnposing asm, a zero for an O, or extra hyphens.
Read a URL from right to left. The true owner is the last two labels before the first slash.
Other Scams Worth Knowing in 2026
Phishing isn't the only threat. Here are the most common attacks and how to shut them down.
Smishing (Text Message Scams)
Fake "failed delivery," "toll fee due," or "bank alert" texts with links. Carriers can't verify these the way they verify calls. Never tap links in unexpected texts. Go directly to the company's app or website instead.
Fake Support Calls and Pop-ups
A pop-up or call claims your device is infected and urges you to call a number or install "support software." Real companies never cold-call about viruses. Close the browser and never grant remote access.
Business Email Compromise (BEC)
An email appears to come from your boss or a vendor asking for an urgent wire transfer or gift cards. Verify any money request through a second channel, like a phone call to a known number.
QR Code Scams (Quishing)
Fake QR codes placed on parking meters, menus, or flyers lead to phishing sites. Preview the URL before loading, and be skeptical of codes asking for payment or login.
MFA Fatigue Attacks
Attackers who already have your password spam you with login approval prompts, hoping you'll tap "approve" to make it stop. Never approve a prompt you didn't trigger.
Fake Invoices and Subscription Renewals
"Your subscription renewed for $499" emails trick you into "canceling" by handing over card details. Check charges in your real account, not through the email.
Your Defensive Checklist
Turn on multi-factor authentication everywhere, ideally with an app or hardware key rather than SMS.
Use a password manager so every account has a unique password and the manager refuses to autofill on fake domains.
Never type a password after clicking an email link. Open a new tab and navigate to the site yourself.
Hover or long-press every link before you trust it.
Verify money and urgent requests through a second channel.
Keep your devices and browsers updated.
The Takeaway
Attackers win by borrowing trust, whether it's a friend's name, a company's logo, or a link that looks familiar. Your best defense is a simple habit: slow down, check the real domain, and never enter credentials on a page you reached by clicking.
Share this with the people in your contact list. One person who spots the fake login breaks the chain for everyone they know.