Phishing has gotten good. AI-written emails in perfect Spanish or English, real-looking logos, domains that read "amazon" until you look closely. We see them every day at our Miami clients. Here are the 6 red flags that still work in 2026 — and 3 real examples we cleaned up last month.
Red flag 1: Manufactured urgency
"Your account will be locked in 24 hours unless you verify." "Your package will be returned." Real banks and shipping companies don't operate on artificial deadlines. They send statements, not countdown threats.
Red flag 2: The sender domain doesn't match the brand
Hover over the sender. [email protected] is NOT Bank of America. Real BofA emails come from @bankofamerica.com — no hyphen, no extra word. This is the #1 catch.
Red flag 3: Generic greeting
"Dear customer" — your bank knows your name. "Estimado cliente" without your name = red flag.
Red flag 4: Suspicious link destination
Before clicking ANY link, hover your mouse over it (don't click). Your email client shows the actual URL at the bottom. If the visible link says "amazon.com" but the actual URL shows "amaz0n-verify.tk" — that's a phishing trap.
Red flag 5: Asking for password, SSN, or wire transfers
No legitimate company will ever ask for your password by email. The IRS does not communicate by email. Your boss will not ask you to buy gift cards over Slack DM.
Red flag 6: Threats and prizes
"You won $10,000!" and "Your account was hacked!" trigger the same emotional response: act now, think later. Phishers exploit that.
3 real examples from Miami clients (May 2026)
Case 1: Brickell law firm. Received "FedEx delivery notice" that was actually a malicious Excel attachment. The macro would have installed ransomware. Red flag: real FedEx never sends Excel attachments.
Case 2: Doral logistics company. CFO got an email "from the CEO" requesting a $48,000 wire transfer for an urgent vendor payment. Sender domain was off by one letter. Red flag: real CEO would call.
Case 3: Hialeah accounting firm. "IRS notice" demanding $2,400 payment via gift cards within 24 hours. Red flag: the IRS does not accept gift cards.
What to do if you got phished
- Don't panic, don't keep clicking.
- If you entered a password — change it on the real site immediately, then enable 2FA.
- If you wire-transferred — call your bank in the next 15 minutes; some are reversible.
- Forward the phishing email to [email protected] and your IT team.
- Don't open any attachments from that sender.
Try our free Phishing Email Detector — paste the email and we analyze 14 red flag signals. For businesses, our anti-phishing training drops click rates from ~28% to ~3% in 6 months. Custom quote after discovery call.