The Email Security Habits That Keep Scams Out of My Inbox
Why Most Advice About Email Security Misses the Point
Most email security guides tell you to look for bad spelling and dodgy logos, but that advice is years out of date. The scams landing in my inbox now are polished, personalised, and often use real company branding lifted straight from the source, copied pixel for pixel from a genuine email. If you're still scanning for typos, you're checking the wrong thing entirely, and you'll miss the ones actually worth worrying about. I've written before about how I identify email phishing day to day, and the short version is that the sender's actual address matters more than anything else in the message. Everything else, the logo, the tone, the formatting, can be faked in minutes with tools freely available online.
The Habits I Actually Rely On Every Day
I don't have a complicated system, just a few habits I run through without thinking, the same way you'd check your mirrors before pulling out of a driveway. I never click a link in an unexpected email, I go to the website directly instead, typing the address myself rather than trusting anything in the message. I hover over links before I trust them, even ones that look like they're from people I know, since a compromised contact's account is one of the most convincing ways a scam email can arrive. And I treat any email that pushes me to act immediately as suspicious by default, because urgency is the oldest trick in the book and the one thing every genuine sender rarely needs from you.
Spotting the Emails That Don't Add Up
The clearest sign something's wrong is usually a mismatch. The sender says they're your bank but the reply address is a string of random letters. The email claims to be urgent but you weren't expecting anything from that company. A request for personal details arrives out of nowhere, dressed up as a routine verification step. None of these need technical skill to spot, they just need you to pause for a second before you respond, which is exactly the one thing a well-crafted scam is designed to stop you doing.
Attachments Get the Same Suspicion as Links
An attachment I wasn't expecting gets treated with exactly the same caution as a link I don't trust. Invoices for orders I didn't place, delivery notices for parcels I'm not expecting, documents that ask me to "enable content" before they'll display properly, these are some of the most common ways malware actually ends up on a device. If I'm not expecting it, I contact the supposed sender through a separate channel to check it's genuinely from them before I open anything, even when the email itself looks completely convincing.
Tools That Do the Heavy Lifting for Me
Vigilance only gets you so far, which is why I lean on a few tools to cover the gaps for the moments I inevitably let my guard down. A password manager like NordPass means even if one account gets compromised through a phishing email, the damage doesn't spread to everywhere else I use the same login, and it won't autofill my details on a lookalike page even when everything else about the message looks genuine. I also keep two factor authentication switched on for anything that matters, so a stolen password alone isn't enough to get in. When I'm on public wifi I'll use NordVPN too, since email login pages are exactly the kind of thing you don't want intercepted on an open network.
The Inbox Rules I Set Up Once and Forgot About
A few small settings do a surprising amount of quiet work in the background. I've got my email client set to display full sender addresses rather than just the display name, so I'm not relying on remembering to check manually every time. I unsubscribe from anything I don't actually read rather than leaving it to pile up, since a bloated inbox makes it easier for one genuine-looking scam to blend in with the noise. And I mark anything suspicious as phishing rather than just deleting it, since that helps train the filter for the next one, both for me and for whoever else uses the same provider.
What I'd Tell Someone Starting From Scratch
Start small. Pick one habit, checking the sender's actual address before you do anything else, and make it automatic before you add another. My Safety Toolkit has the tools I use if you want a starting point, and if something does land in your inbox that worries you, report it through Action Fraud so it's on record, since that's part of what helps the next version of the scam get caught earlier. If you're ever unsure about something that's turned up, feel free to get in touch and I'll take a look.