phishing_spotting v1.0.0

name: phishing_spotting description: Teaches you to spot phishing attempts through sender, message, and URL red flags, plus the quick verification habits that settle most cases in under a minute. Use when someone asks how to tell if an email or message is a scam, wants to check a suspicious link or sender, or needs a calm step-by-step response for something that landed in their inbox.

Phishing Spotting

Purpose

Most phishing attempts are easy to catch once you know where to look. This skill gives you a short checklist for three things: who sent it, what it says, and where its links actually go. Then it covers the verification habits that resolve the rest, and exactly what to do with a message you do not trust. No panic needed. A steady routine beats vigilance-by-anxiety every time.

Workflow

Work the steps in order. Most cases resolve at step 2 or 3.

1. Check the sender, not the display name. The name shown ("Bank Security") means nothing. Look at the actual address. A real bank writes from its own domain. security@wellsfargo.com is plausible; wellsfargo.security@outlook.com or noreply@wellsfargo-secure-alert.com is not. On mobile, tap the name to reveal the address. If you only see a display name and no address, treat that as a red flag by itself.

1. Read the message like a stranger wrote it. Legit organizations do not create urgency. Real alerts never say "your account will be closed in 24 hours unless you click here." Watch for: pressure to act fast, threats about your account or money, unexpected attachments, requests for passwords or codes (no real company asks for these by email), greetings that are generic ("Dear Customer") from someone who knows your name, and sloppy details like typos or logos that look slightly off.

1. Inspect every link before clicking. Hover on desktop, long-press on mobile, to see the real destination. The visible text can say anything; the actual URL is the truth. yourbank.com is fine. yourbank.secure-login.tk is not: the real domain is the part just before the final extension, and anything unfamiliar tacked onto it is suspicious. Shortened links (bit.ly and friends) hide the destination entirely, so never trust one from a stranger.

1. Verify through a separate channel. If a message claims to be from your bank, utility, or boss, do not use its links or reply to it. Open the organization's site yourself by typing the address or using a bookmark, or call them on a number you already have. This one habit kills nearly all phishing, because the attack depends on you entering through their door instead of yours.

1. If it is suspicious, act on it calmly. Do not click anything, do not reply, do not download the attachment. If it came to your work inbox, forward it to your IT or security team (many use a report-phishing address). If it is personal, delete it. If you already clicked or entered details, change that password immediately, turn on two-factor authentication if it is not on, and watch your account for anything odd over the next few days.

Output Contract

When applying this skill, give the user:

• A plain verdict: likely phishing, likely legitimate, or cannot tell from what you have.
• The specific evidence: which red flags you saw (sender mismatch, urgent tone, suspicious URL), quoted or described concretely.
• One next step, matched to the verdict: how to verify a suspicious message, or where to report it if it is clearly phishing.
• No lecture. Keep it short. If they only pasted a message for a quick check, answer the check first and skip the full checklist.

Operating Rules

• Never click, open, or fetch a suspicious link to "test" it. Check it by reading the URL text, not by visiting it.
• Never ask for or handle the user's passwords, codes, or account numbers while doing this. Verification happens on their side, through their own trusted channels.
• Do not declare something safe. You can say "no red flags found" but phishing can be well made, so the verify-through-a-separate-channel habit still applies when money or accounts are involved.
• Keep the tone practical. The goal is a routine they actually use, not a scary list they ignore.
• If the message is a one-to-one impersonation attempt (a "boss" asking for gift cards, a "friend" with a sudden urgent favor), the same rules apply: verify through a channel you started, never the one the message gave you.