THE PATRIOT KID

🎣 How Phishing Actually Works

Phishing doesn't beat your firewall — it beats you. An email impersonates someone you trust (your bank, Microsoft, a vendor, even your own boss) and manufactures urgency so you act before you think.

The tricks are almost always the same:

• A lookalike domain: firstbank-verify.com instead of the real one
• A countdown or threat — “account will be closed”
• A link to a login page that looks identical to the real one
• A display name that hides the real sender address

Over 90% of business breaches start with a phishing email. It's cheap, it scales, and it only has to work once.

🔒 SPF, DKIM & DMARC: Protect Your Own Name

Attackers don't just phish you — they impersonate your business to phish your customers. Three DNS records stop that:

• SPF — lists who's allowed to send mail as your domain
• DKIM — cryptographically signs your mail so it can't be forged
• DMARC — tells inboxes to reject anything that fails, and reports who's trying

Without them, anyone can send email that looks like it came from you — and your real mail is far more likely to land in spam. With them, spoofed messages bounce.

⏳ The 5-Second Test

Before you click anything in an email that creates urgency:

• Hover the link — does the address match the real company?
• Check the sender's actual domain, not the display name
• When in doubt, don't reply — open a new tab and type the address yourself
• Verify by phone using a number you already have

Want your domain checked and locked down? Chuck will run your SPF, DKIM & DMARC and fix what's missing.