I got a password reset message from a domain that was only one letter off. I did not click. How do people verify real security mail?
Account recovery email came from a wrong domain
3 thoughtful replies
Open the real site from a bookmark and check security settings there. Never use the email buttons when something looks off.
I report phishing samples through the provider’s official abuse address when I can find it on their site.
Hovering (not clicking) links on desktop shows a lot. On mobile I just delete and visit the real app.