What is the most important security tool to install first?

A password manager, because credential stuffing is the cause of the majority of account compromises. Once every account has a unique password, the risk of one breach cascading to other accounts drops to near zero.

How do hackers actually get into people's accounts?

Most account compromises don't involve sophisticated hacking. They rely on reused passwords from old breaches, phishing emails that collect credentials, or social engineering. Technical attacks like brute force are rare against well-configured accounts.

Is it worth paying for privacy tools?

The core stack — password manager, antivirus, private browser — costs under $30/year combined (Brave is free; NordPass has a free tier; TotalAV starts at $19/year). That's cheaper than resolving a single identity theft incident, which averages hundreds of hours of victim time.

How to Spot a Phishing Email in 10 Seconds

24 Jun 2026 · 3 min read · Comments

Phishing is the most common way accounts get compromised. Modern scam emails look convincingly real. Here are the handful of telltale signs that give them away every time.

An Example Phishing Email

From: security-alert@paypa1-support.com ⚠ suspicious domain

To: you@email.com

Subject: ⚠️ Your account has been limited — action required within 24 hours

Dear Valued Customer,

We have detected unusual activity on your PayPal account. To avoid permanent suspension, you must verify your information immediately.

Failure to act within 24 hours will result in your account being permanently closed.

Verify My Account Now

PayPal Inc. · 2211 North First Street · San Jose, CA 95131

That email has at least five red flags visible before you even read the body. Here's how to spot them:

1. Check the Sender's Email Address

The display name can say anything — "PayPal Security", "Apple Support", "Your Bank". Click on it to reveal the actual address.
Look carefully at the domain. paypa1-support.com is not PayPal. Scammers use typos, hyphens, and look-alike characters (1 instead of l).
Legitimate companies always email from their own domain: @paypal.com, @apple.com, etc.

2. Spot the Artificial Urgency

Phishing emails create panic. "24 hours", "immediately", "permanently closed", "action required" — these phrases are designed to make you click before you think.
Real companies don't threaten to delete your account in 24 hours over an email. If something were genuinely wrong, you'd see a notice when you log in.

3. Hover Over Links Before Clicking

On a computer, hover your mouse over any link without clicking. The real destination appears in the bottom-left corner of your browser.
A button that says "Verify My Account" might actually lead to paypal-verify-login.ru. The button text is decoration — the URL is what matters.
On mobile, press and hold a link to preview the URL before it opens.

4. Generic Greeting

"Dear Valued Customer" or "Dear User" means the sender doesn't actually know your name — because they sent this to thousands of random email addresses.
Your bank, PayPal, and Amazon all know your name. They will use it.

5. Unexpected Attachment

An invoice you didn't request. A "shipping label". A "document for your review". If you didn't expect an attachment, don't open it.
Malicious attachments are commonly disguised as PDFs, Word documents, or ZIP files. Opening them can install malware silently.

10-SECOND CHECKLIST

☐ Is the sender's domain exactly right?

☐ Does it create urgency or threats?

☐ Does the link URL match the company?

☐ Does it use your real name?

☐ Were you expecting this email?

If any answer is suspicious — don't click. Go directly to the company's website by typing the address yourself.

What to Do If You're Not Sure

Don't click any links in the email. Instead, open a new browser tab and type the company's address directly (e.g. paypal.com).
Log in there. If something is actually wrong with your account, you'll see a notice after logging in.
Report the phishing email using your email client's built-in "Report phishing" option. This helps train filters to catch similar emails for everyone.

Sam Feldman

"A good banner has no fixed form and has no inherent meaning."

Austin, TX · https://sams.blog/weekly

✓