The Email Security Habits That Keep Scams Out of My Inbox

Why Most Advice About Email Security Misses the Point

Most email security guides tell you to look for bad spelling and dodgy logos, but that advice is years out of date. The scams landing in my inbox now are polished, personalised, and often use real company branding lifted straight from the source. If you're still scanning for typos, you're checking the wrong thing. I've written before about how I identify email phishing day to day, and the short version is that the sender's actual address matters more than anything else in the message.

The Habits I Actually Rely On Every Day

I don't have a complicated system, just a few habits I run through without thinking. I never click a link in an unexpected email, I go to the website directly instead. I hover over links before I trust them, even ones that look like they're from people I know. And I treat any email that pushes me to act immediately as suspicious by default, because urgency is the oldest trick in the book.

Spotting the Emails That Don't Add Up

The clearest sign something's wrong is usually a mismatch. The sender says they're your bank but the reply address is a string of random letters. The email claims to be urgent but you weren't expecting anything from that company. A request for personal details arrives out of nowhere. None of these need technical skill to spot, they just need you to pause for a second before you respond.

Tools That Do the Heavy Lifting for Me

Vigilance only gets you so far, which is why I lean on a few tools to cover the gaps. A password manager like NordPass means even if one account gets compromised through a phishing email, the damage doesn't spread to everywhere else I use the same login. I also keep two factor authentication switched on for anything that matters, so a stolen password alone isn't enough to get in. When I'm on public wifi I'll use NordVPN too, since email login pages are exactly the kind of thing you don't want intercepted on an open network.

What I'd Tell Someone Starting From Scratch

Start small. Pick one habit, checking the sender's actual address before you do anything else, and make it automatic before you add another. My Safety Toolkit has the tools I use if you want a starting point, and if something does land in your inbox that worries you, report it through Action Fraud so it's on record. If you're ever unsure about something that's turned up, feel free to get in touch and I'll take a look.