The four flags at a glance
| Flag | Ask yourself |
|---|---|
| 1. Lookalike sender | Who is really writing? |
| 2. Pressure to act fast | Who benefits from the hurry? |
| 3. Link does not match | Where does it really go? |
| 4. Asks for a password or code | Would the real service ask? |
Red flag 1: the sender address is a lookalike
The display name can say anything (“HR Department”, “Your Bank”). The real information is the address behind it: hr@nakhlora-group.example is not hr@nakhlora.example. Attackers register domains with one letter different, an extra word, or a different ending (.co instead of .com). On a phone, the address is often hidden — open the message fully and check before acting.
Red flag 2: pressure to act fast
“Expires in 60 minutes.” “Your account will be closed today.” Urgency is the tool that makes people skip the checks they normally do. A real offer, a real invoice and a real IT problem all survive an hour of verification. When a countdown is the loudest thing in the message, ask yourself who benefits from the hurry.
Red flag 3: the link does not match
Hover over the link (or press and hold on a phone) and read the actual destination. The button can say “View voucher” while pointing somewhere unrelated. The same applies to QR codes — a code can send you anywhere, so treat it like a link you cannot read, and type the address you know instead. The padlock in the browser bar only means the connection is encrypted; scam sites have padlocks too.
Red flag 4: it asks for your password or a code
No legitimate service asks for your password by email, and no legitimate IT team asks you to read out a one-time code. A request for credentials — or a login page that appears after clicking — is the aim of most phishing. If you already typed your password, change it and report it immediately.
The same flags on other channels
- SMS: a delivery fee in dirhams you were not expecting, with a payment link — flags 3 and 4 together
- Phone: a caller from “your bank” or “IT support” who rushes you and asks for a code — flags 2 and 4
- Messaging apps: a “colleague” asking for a quick favour on a number you have not saved — verify by calling the number you already have
- Video calls: an unexpected “executive” call asking for secrecy — verify through their assistant or a known channel
What to do when you spot one
- Do not click, do not reply, and do not forward it to colleagues to ask “is this real?”
- Report it through your company’s report button or security email — the one shown on the end card of your training
- If you already clicked or entered a password: report it anyway, faster. See our guide on the first minutes after clicking a phishing link
Common mistakes
- Checking only for spelling mistakes: AI-written phishing reads cleanly in English and Arabic
- Trusting the logo: logos are copied, not proof
- Trusting the padlock: it only means the connection is encrypted
- Replying to ask “is this you?” — the attacker will say yes
- Deleting instead of reporting: the security team cannot warn others about a campaign they never see
How our courses cover it
Course 2055, “The Eid Voucher”, walks all four flags through one story set around an Eid voucher email — including the QR-code version and AI-written phishing. The flags then return across the library: smishing (2044) on SMS, vishing (2063) on calls with AI voice cloning, payment fraud (2069) on changed bank details, and the executive version in the high-risk users course (2070).