1.4 Human-Centered Security Habits
Verify the Envelope, Not the Display Name
The "From" line is free text; machines should be consulted instead. SPF (RFC 7208) publishes which IPs may send for a domain, e.g. v=spf1 include:_spf.google.com ~all. DKIM (RFC 6376) attaches an RSA or Ed25519 signature over selected headers and the body, with the public key in a DNS TXT record. DMARC then requires the visible From to align with the SPF or DKIM domain and can publish p=reject to kill forgeries outright. In a client, open the raw headers and read Authentication-Results: a spf=pass on a totally different envelope-from domain is a friendly-from spoof. Also scan for homoglyph registrations rendered as punycode, such as xn--paypa-btf8k.com.
Read URLs Like a Parser
A URL is scheme://user:pass@host:port/path?query#frag, and browsers paint only part of it. The host is the last label before the first slash, so paypal.com@evil.example, under any scheme, sends you to evil.example, not PayPal. Percent-encoding hides structure: %2e%2e is .., and a trailing .paypal.com.evil.example is still evil. Compare the registrable domain against the Public Suffix List rather than eyeballing. Paste the link into a plain text field to reveal embedded newlines or padding, and remember a QR code encodes the identical string — it is not safer, just un-inspectable.
Break the Urgency Loop Out-of-Band
Every manipulation shares one mechanism: compressed time plus a channel the attacker chose. Counter it by moving to a channel you chose. If an email claims a fraud alert, call the number printed on your last statement or use the official app — never the number or link in the message. For a payment change, the control is a callback policy: new bank details are activated only after a call to the vendor number already on file. For voice calls, agree on a challenge phrase or safe word that a cloned voice cannot know, and ask something with no searchable answer.
Report First, Then Delete
Deleting a lure destroys the evidence your filters need to learn. Forward it intact (headers included) to your IT report button or to reportphishing@apwg.org, then delete. On the account side, habits beat heroics: a password manager, passkeys instead of SMS where offered, and auto-updates left enabled — most successful phishing works on stale software, not on clever writing.
Architecture Diagram
Key Takeaways
- Trust
Authentication-Results, alignment, and the envelope-from — never the display name. - The host is the last label before the first slash;
paypal.com@evil.exampleis an evil.example link. - Urgency, secrecy, and a channel hop are the payload; respond out-of-band using numbers on file.
- Report lures intact before deleting them, so filters and colleagues learn.
- Passkeys, unique stored passwords, and auto-updates defeat most phishing even when attention lapses.