The same four flags, every channel

Phishing is not a look. It is a structure. The lure asks you to do something, presses you to do it now, arrives on a channel the real sender does not normally use, and props up credibility with a detail that does not quite hold.

You do not need to be a security expert to use this. Two flags means verify on a channel you already use with that person. Three or four means the message is the attack.

• Action ask Click, pay, transfer, sign in, read an OTP, install, or approve something unusual.

• Urgency A deadline, an authority, or a consequence engineered to short-circuit thinking.

• Channel mismatch A new number, a new portal, or a channel this person does not normally use with you.

• Weak prop Look-alike domain, odd tone, secrecy ask, or details that contradict each other.