1. We mapped 70 red flags across 18 types of real attacks. Which one appeared in the most?
Answer: A request that leans on authority or trust. Pressure from someone who seems to be in charge — a boss, a bank, the police, a supplier — showed up in 13 of the 18 attack types. Typos showed up in almost none.
2. Second most common in that map: threats of something bad happening if you don’t act. True or myth?
Answer: True. “Your account will be closed”, “you’ll be fined”, “the deal falls through”: threats and negative consequences appeared in half of all attack types we mapped.
3. A sender address differs from the real one by one swapped letter. How common is that trick?
Answer: Very common — one of the top three signals. Lookalike domains appeared in 8 of 18 attack types. In April 2026 a Singapore trading firm sent USD 6.6M after two letters in a supplier’s domain were swapped.
4. “N.E.X.I”, “P a y P a l”, “Micr0soft” — what is this trick for?
Answer: Slipping a brand name past filters. Splitting a brand name with dots, spaces or look-alike characters hides it from simple filters while you still read the name. It appeared in 7 of 18 attack types.
5. True or myth: if an email passes security checks like SPF and DKIM, it’s safe.
Answer: Myth. Passing authentication only proves which server sent it. Compromised real mailboxes and abused legitimate services pass every check — and still carry fraud.
6. Which mix of signals is the strongest warning?
Answer: Urgency, secrecy and a new bank account together. No single signal proves fraud. A combination — weight of evidence — does. Urgency plus confidentiality plus a new payee is a classic pattern.
7. A message asks you to move the conversation from email to WhatsApp or a phone call. Why does that matter?
Answer: It takes you away from the channel your company can check. Switching channels appeared in 5 of 18 attack types. It moves the attack to places with fewer filters and no record.
8. The padlock / HTTPS in your browser means:
Answer: The connection is encrypted, not that the site is honest. Most phishing sites use valid HTTPS — over three-quarters already by 2020 (APWG). A padlock tells you nothing about who runs the site.
9. Which request is a red flag in almost every scam type, at work and at home?
Answer: “Don’t tell anyone about this yet”. Secrecy stops you from checking with the people who would spot the fraud. Real processes rarely forbid you to ask a colleague.
10. What’s the single best response when several red flags line up?
Answer: Verify through a channel you already know. Asking the sender to confirm only reaches the scammer. A call to a number you already have, or a colleague you know, breaks the chain.