Lesson 4 of 9 · about 16 minutes

Phishing and Social Engineering

You'll be able to

Recognize the pressure tactics in phishing emails, texts, DMs and calls
Read a URL from the right to find the domain that actually controls it
Verify a suspicious request out of band before acting
Report phishing to the right places and recover if you clicked

Writers are easy marks for phishing. We open attachments from strangers for a living. We click links in tips. We want the document that proves the story. Attackers know this, and the best phishing aimed at reporters looks exactly like a tip.

The FBI's Internet Crime Complaint Center received 191,561 phishing and spoofing complaints in 2025 (IC3 2025 report). Business email compromise, where a real or faked account asks for money or data, cost reported victims about $3.05 billion. Most of it started with one convincing message.

What they all have in common

Every phishing message tries to make you act before you think. The costume changes: a bank, your editor, a platform, a source. The levers are the same.

Lever	Sounds like	Your countermove
Urgency	"Within 24 hours or your account will be suspended"	Real deadlines survive a ten-minute check
Authority	"From the office of the county administrator"	Look up the office yourself and call
Fear	"Copyright violation reported on your post"	Log in to the platform directly, not through the link
Curiosity or greed	"Leaked budget memo attached"	Open unknown files in a safe viewer, never as a downloaded program
Helpfulness	"Can you read me the code so I know you're a real reporter?"	Codes sent to you are never for anyone else
Secrecy	"Don't loop in anyone else, this is sensitive"	Isolation is the tell. Loop someone in.

Invented examples

These are made up, but each is modeled on a common pattern. Names, towns and domains are fictional.

Example 1: the shared document

From: Cutter Falls City Clerk <records@cutterfalls-gov.org>
Subject: RE: Your records request #4471

The documents responsive to your request are ready.
View securely: Shared Drive > Rate_Study_Final.pdf
Sign in with your email to access.

Tells: the city's real domain would be something like cutterfalls.gov, not cutterfalls-gov.org. You may well have a records request open, which is why it works. The "sign in with your email" page collects your password. Check: go to the records portal you used to file the request, or call the clerk's number from the city website.

Example 2: the platform warning

Your newsletter payouts have been paused due to a
verification issue. Confirm your identity within 48 hours:
https://login.substack.com.account-review.help/verify

Tells: payment fear plus a deadline. The link looks like Substack until you read it properly (see below). Check: open your newsletter dashboard from a bookmark or by typing the address.

Example 3: the tipster's attachment

I work in the county road department. They're hiding the
real cost of the bond. Everything is in the zip, password 2026.
Please don't tell anyone I sent this.
Attachment: bond_docs.zip

Tells: a password-protected zip is a classic way to slip malware past email scanners. Secrecy pressure. Check: reply asking for the documents as plain PDFs, or ask the person to move to Signal and describe what they have first. Real sources rarely mind. If you must open it, do so on a device that holds nothing sensitive, and never run anything ending in .exe, .scr, .js, .bat or a document that asks you to "enable content."

Example 4: the verification code

Hi, I saw your piece on the library board. I have more,
but I need to be sure you're legit. I'm sending you a code,
just text it back to me.

Tells: the code is a sign-in or account-setup code for your phone number, triggered by them. Reading it back hands them an account. Check: there is nothing to check. Never share a code you did not request for your own login.

Example 5: the phone call

"Hi, this is Jordan from the help desk at the paper. We're seeing odd logins on your account. I'm going to push a prompt to your phone; just tap Approve so I can lock it down."

Tells: a stranger asking you to approve a sign-in is the sign-in. This is how push bombing ends: with a friendly voice. Check: hang up and call the help desk number from your own records.

Reading a link the right way

Browsers and email apps let you see where a link really goes. On a computer, hover over it and look at the bottom corner of the window. On a phone, press and hold the link until a preview shows the address. Then read the host name, the part between https:// and the first single slash, from right to left.

Example: dissecting a URL

https://login.substack.com.account-review.help/verify

Strip the front: remove https://. Stop at the first slash: login.substack.com.account-review.help.
Read from the right. The last part is the top-level domain: .help.
One step left is the name someone bought: account-review. So the registered domain is account-review.help.
Everything to the left (login.substack.com.) is a subdomain. The owner of account-review.help can type anything there.

Compare https://substack.com/sign-in: host substack.com, registered domain substack.com. That one is real.

Watch also for swapped letters (rn for m, as in rnicrosoft.com), extra hyphens and lookalike endings like .co for .com.

A password manager helps here for free. It fills your password only on the exact domain where you saved it. If you land on a login page and your manager offers nothing, stop and look at the address. Passkeys and security keys go further: they will not work on the fake domain at all, which is why CISA calls FIDO methods phishing resistant.

Verify out of band

Out-of-band verification means checking through a channel the attacker does not control. If the request came by email, check by phone. If it came by text, check by email or in person. Always use contact details you already had or looked up yourself, never the ones in the message.

The rule for money, passwords, codes and files: if a message asks for any of them, confirm through a second channel before you act. No exceptions for your editor, your bank or your mother.

Set this up with the people you work with before trouble starts. Agree with your editor that payment changes and urgent favors are always confirmed by voice. Some newsrooms and families use a code word for this. It feels silly until the day a cloned voice calls.

Common mix-ups

Claim: "The lock icon in the browser means the site is safe." What the evidence shows: The padlock means the connection is encrypted. Phishing sites get certificates too. It says nothing about who runs the site.
Claim: "Phishing emails are full of typos." What the evidence shows: Some are. Targeted ones are often clean, and AI writing tools have made polished fakes cheap. Judge the request, not the spelling.
Claim: "It came from my editor's real address, so it's safe." What the evidence shows: Compromised accounts send real email. That is the business email compromise pattern behind billions in IC3-reported losses.

If you clicked

Everyone clicks eventually. Speed matters more than shame.

If you typed a password, change it right away from a clean device, starting with that account and anywhere you reused it.
If you typed a code or tapped Approve, sign out all other sessions from the account's security page and check its recovery email and phone.
If you opened a file, disconnect from the internet, run your security software's scan and watch for new browser extensions or apps.
If you gave out a Social Security or bank number, follow the steps at IdentityTheft.gov.
Tell the people the attacker might target next: your editor, your sources, your newsletter readers.

Then report it. The FTC says to forward phishing emails to reportphishing@apwg.org, forward phishing texts to 7726, and report at ReportFraud.ftc.gov (FTC). Use your email provider's "Report phishing" button too.

Reporting angle

Phishing waves often hit local institutions first. If residents of your town start getting fake utility shutoff texts or fake permit emails, ask the utility or city: how many reports have they logged, have they notified the FBI or state attorney general, what do their real messages look like, and what is the official domain? The IC3 annual report breaks complaints down by state, which gives you a baseline number for context.

Try it

Open your spam folder and pick three messages. For each, find the real registered domain of every link by reading right to left, and list which levers (urgency, authority, fear, curiosity, helpfulness, secrecy) it pulls. Then write a two-line verification agreement with your editor or a close collaborator, covering money, codes and urgent file requests, and send it to them by a channel other than email.

Check yourself

1. In the link https://login.substack.com.account-review.help/verify, which domain actually controls the page?

2. A message from your editor's account asks you to buy gift cards for a source, urgently. What is the right move?

3. Where does the FTC say to forward phishing text messages?

4. Someone who says they want to give you a story asks you to read back a six-digit code that just arrived by text to 'prove you're a real reporter.' What is happening?

5. How many phishing and spoofing complaints did the FBI's IC3 receive in 2025?

Terms in this lesson

Phishing: A fake message that tries to get you to hand over a password, code, money or file, or to open malware.
Spear phishing: Phishing written for one specific person, using details about their work or contacts.
Pretexting: Inventing a believable story and role, such as a fellow reporter or IT support, to get information.
Out-of-band verification: Checking a request through a different channel you already trust, like calling a saved number.
Registered domain: The part of a web address someone actually bought, such as example.com, which controls every subdomain to its left.

Full glossary

Sources

FTC, How To Recognize and Avoid Phishing Scams checked 2026-10
FBI Internet Crime Complaint Center, 2025 IC3 Annual Report checked 2026-10
CISA, Implementing Phishing-Resistant MFA checked 2026-10
Digital Safety Kit, Committee to Protect Journalists checked 2026-10