Before clicking any link, hovering over it (on desktop) or long-pressing it (on mobile) reveals the actual destination URL, which often exposes a mismatch with the sender's claimed identity — a classic phishing red flag. The 's' in HTTPS stands for secure, meaning data sent between your browser and the site is encrypted; while HTTPS alone doesn't guarantee a site is legitimate, its absence on a page asking for sensitive information is a serious warning sign. Email red flags include a sender address that looks almost right but not quite (like 'support@amaz0n.com'), unexpected attachments, generic greetings on messages claiming to be personal, and pressure to act immediately. The safest response to a suspicious message is to contact the organization directly through a known, independently verified channel — never through the contact details provided in the suspicious message itself.