How to Spot Phishing Emails and Fake Websites
The good news: phishing is a pattern, and patterns can be learned. Here’s what to look for, starting with the single most useful skill.
The one skill: read the domain, right to left
Look at this link: https://bank.absa.co.za.login-verify.com/secure
Where does it really go? Read the domain from right to left, ignoring everything after the first single slash. The true domain is login-verify.com. Everything before it (bank.absa.co.za) is just a folder name on that domain, decoration dressed up to look like a bank. The real bank’s traffic would end at absa.co.za, with nothing parked between that and the .co.za.
Attackers buy lookalike domains in bulk: standardbank-login.com, sars-refund.co.net, fnb-secure.co, microsoft-support.net. Some go further with lookalike characters (rn for m, 0 for o). Slow down and read: subdomain before domain, domain before everything.
The urgency machine
Phishing messages share one engine: urgency. Your account will be closed in 24 hours. A parcel is waiting. SARS owes you a refund and needs your banking details today. A manager needs an urgent invoice paid, and is “in a meeting” and can only be reached by email.
Urgency exists to move you from thinking to clicking. Any message that demands action within hours, especially one threatening a consequence for not acting, deserves the slow treatment: stop, and check through a channel you choose yourself. Call the bank on the number on your card, not any number in the email. Log into the site by typing its address yourself. Open the company’s website in a new tab instead of clicking the link.
Fake sites: near enough to be dangerous
A phishing kit can clone a login page in minutes, and the copy will have a padlock, because HTTPS certificates are free and automatic now. So the padlock tells you the connection is encrypted, and nothing about who owns the other end (our browser privacy guide says the same).
Before typing a password into any page, look at the address bar. Not the page itself, the address. A perfect copy of your bank’s login page at the wrong address is a perfect copy of a donation to a criminal.
1. Mismatched or lookalike domains (read them right to left).
2. Urgency plus a threat: “act within 24 hours”.
3. Greetings like “Dear Customer” from a service that knows your name.
4. Requests for passwords, OTPs or PINs. No legitimate service asks for an OTP you just received; whoever has that OTP is logging in as you right now.
5. Unexpected attachments, especially invoices, waybills and “voicemail” links.
6. Slightly wrong email domains in the sender (your bank writing from a gmail address, or @absa-secure.co.za instead of @absa.co.za).
7. A job offer or prize that requires you to pay a fee first.
When the email impersonates someone you know
The most expensive phishing doesn’t look like a stranger’s email. It looks like a colleague asking you to check a document, a supplier sending “updated banking details” on a real-looking invoice, or the boss asking for a favour. The supplier email with new banking details deserves a phone call to a number you already have, every time. Business email compromise works precisely because the request looks routine and comes from a trusted name.
What to do if you clicked
- If you typed a password: change it now, on the real site, and change it anywhere else you reused it.
- If you gave an OTP: contact the bank immediately; the fraudster is mid-login.
- If you paid or shared card details: call the bank’s fraud line and dispute it. Speed matters.
- Report it: forward phishing emails to your bank’s fraud address and report via the Internet Service Providers’ Association’s take-down channels, so the fake site gets taken down.
- Then tell someone. Colleagues, family, the group chat. The next person to receive that email is probably someone you know.
Why password managers help here
A password manager only auto-fills your bank password on the exact domain where it was saved. On a lookalike domain, it does nothing, which is itself a warning sign: if the password manager doesn’t offer the login, the page isn’t the site you think it is. That’s a free, silent phishing check running on every login you make.
If your business handles client payments or sensitive records, staff awareness is the layer that matters most. We help businesses across the Helderberg with the practical side: email filtering, backups and ongoing IT maintenance that assumes someone, someday, will click.
Frequently asked questions
What is the first thing to do if I clicked a phishing link?
If you entered a password, change it immediately on the real site, and anywhere you reused it. If you entered an OTP, call your bank’s fraud line straight away. If you shared card details or paid, the bank’s fraud line is the first call, and speed matters more than embarrassment.
Can phishing emails be blocked before they reach staff?
Much of it can. Email filtering catches the bulk, but no filter is perfect, which is why awareness matters: staff who can read a domain right to left and recognise urgency tricks are the layer that catches the rest. We set up both filtering and practical training for businesses.
Do I need antivirus if I never click anything?
Yes. Not all infections arrive by clicking; they arrive through outdated software, weak router settings, and devices on your network. Layered protection (updates, antivirus, firewall, backups) doesn’t depend on perfect behaviour from you.
Staff are your best firewall, once they’re trained.
ARTRIBE Tech helps businesses with email security, backups and ongoing IT care that assumes people will click, and limits the damage when they do.
Talk to us about IT security →