Phishing remains the most common way accounts are compromised. Modern campaigns look polished, so the old advice about spelling mistakes is not enough.
1. Urgency with a deadline
Messages that demand action within hours are trying to stop you from thinking. Legitimate services give notice and alternatives.
2. Mismatched sender and reply-to
Display names are trivially forged. Expand the full address, and check whether the reply-to points somewhere different.
3. Links that do not match their text
Hover before clicking. A link reading accounts.example.com that actually resolves to example.com.login-check.net is a classic.
4. Requests to move off-platform
Asking you to continue on a messaging app, or to open an attachment to "view the secure message", is a common pattern.
5. A login page you did not ask for
If a message sends you to sign in, close it and navigate to the service yourself. Hardware security keys help here because they refuse to authenticate to the wrong domain.
When in doubt, do not reply and do not click. Verify through a channel you already trust.