Phishing succeeds against people who know what phishing is. The messages are written to reach a decision before careful reading begins.
Urgency removes the interval where doubt lives
Almost every fraudulent message imposes a deadline: an account will be closed, a package returned, a payment reversed, access suspended within hours.
The purpose is to compress the gap between reading and acting, because scrutiny happens in that gap and the message cannot survive it.
Legitimate institutions rarely require action within minutes, and the presence of a short deadline is a more reliable signal than any detail of the message's appearance.
Authority reduces the willingness to verify
Messages impersonate banks, schools, employers, delivery services and government agencies, all entities where a recipient assumes she is the party who might be at fault.
That assumption discourages checking, since verifying implies doubting an institution, and many people find that socially uncomfortable even in a private interaction.
Workplace versions exploit hierarchy directly, with a request appearing to come from a senior person, where verifying carries an additional perceived cost.
The pretext is tailored using public information
Employers, school affiliations, sports teams and family relationships are frequently public, and a message referencing them accurately feels verified before any verification occurs.
Recipients treat specific detail as evidence of legitimacy, when it is only evidence that the sender did research, which takes very little time.
Students are unusually exposed here, because school directories, team rosters and activity announcements publish exactly the affiliations a convincing pretext requires.
Credential capture is the usual objective
Most messages aim to have the recipient enter a password on a page that looks correct, since a working credential is more valuable and more durable than a single payment.
Codes sent by text can also be requested directly, and a caller asking a person to read back a verification code is attempting to complete a login already in progress.
Payment requests appear too, usually in forms that are difficult to reverse, such as gift cards, wire transfers or peer payment applications intended for people who know each other.
The habit that works is procedural
Rather than judging messages, contact the institution through a route obtained independently: a number from a card, a bookmark, an address typed manually.
That habit does not require detecting anything, which is why it holds up against well-made messages that defeat inspection.
Anyone who has entered credentials on a suspicious page should change that password and any reused ones immediately, and where money or identity documents are involved, the institution and law enforcement are the appropriate next contacts.