Ilia Nikolaevich Zavialov on messages, links and attachments

In the overwhelming majority of cases the link leads to a page that looks like the sign-in screen of a familiar service and asks for a login and password. The loss happens at the moment of entry, not at the moment of opening.

Hence the practical conclusion: the rule is not «do not open links» but «do not enter data on a page you reached from a message». Opening the service yourself by typing the address costs ten seconds.

What matters is what sits immediately before the first single slash: in an address like bank.example-login.com the real domain is example-login.com, and the word bank at the start means nothing.

A padlock in the address bar means only that the connection is encrypted. Fake pages have obtained certificates automatically and free of charge for years, so the padlock says nothing about the owner of the site or about their honesty.

A compromised account sends attachments to the entire contact list, and they arrive from a real person, inside a real conversation, often as a reply to a genuine old thread.

Confirmation costs one message in another messenger or one call. If the sender does not confirm, the attachment stays closed.

Services really do ask you to confirm an email or sign in again. The scheme exploits the fact that the action is familiar and substitutes only the address at which it is performed.

The check is the same: close the message, open the service yourself and see whether the notice is there. If the action is real, it will be waiting for you inside the service.

The first thing whoever takes an account does is change the linked email and number so that recovery goes to them. So the check covers not only the password but the recovery contacts section.

The second sign is active sessions and devices. Almost every large service has a list of sign-ins, and an unfamiliar line in it means access is open right now.