What is a best practice to protect yourself from phishing attempts?

• A. Verify the sender's email address before clicking
• B. Share your password with IT to verify identity
• C. Click all links in suspicious emails
• D. Respond with sensitive information to verify

Answer: (A)

Verifying who sent a message before taking any action is a key defense against phishing. The best practice is to check the sender’s email address before you click links or enter information. Phishers often imitate legitimate addresses by using look-alike domains or spoofed display names, so the visible name isn’t enough. Inspect the actual domain in the sender’s address, watch for typos or odd endings, and, if something seems off, don’t trust the message. Instead, reach out through official channels—use the organization’s website or known IT contact info—to confirm legitimacy, and report suspicious messages.

Sharing your password with IT to verify identity is not appropriate and you should never disclose passwords; legitimate teams won’t ask for them this way. Clicking all links in suspicious emails is dangerous, as links can lead to fake login pages or malware. Responding with sensitive information to verify identity is exactly what these scams try to elicit, and should be avoided.