How to Spot a Phishing Email: Up-to-Date Warning Signs for 2026

TL;DR: With the help of AI, phishing in 2026 now writes fluent Turkish and imitates corporate identities almost perfectly. The classic "be suspicious if there is a spelling mistake" instinct is over. The warning signs are now subtler: urgency and threat language, a different domain appearing when you hover over a link, a mismatch between the sender's display name and the actual email address, unexpected attachments (.zip, .htm, .iso), and a request for an MFA code or personal information through an unfamiliar channel. If in doubt, the rule is clear: do not click, do not reply, do not open the attachment. Verify first through a second channel.

What Is Phishing, and Why Is It Rising in 2026?

Phishing is a social engineering attack in which the attacker, by impersonating a trusted organization or person, tries to steal a password, card information, a corporate identity, or a multi-factor authentication (MFA) code from the victim. The target may be individual users, but in recent years finance, IT, and executive assistant roles at SMEs and large organizations in particular have become priority targets.

There are two main engines behind the surge in 2026. The first is generative AI. ChatGPT, Gemini, and open-source models have made it possible for an attacker whose native language is not Turkish to produce flawless text that imitates a corporate style. The second is PhaaS, that is, Phishing as a Service. Just like the Ransomware as a Service logic in ransomware, subscription-based phishing kits are rented; the attacker obtains a ready-made template, hosting, and a panel without needing technical knowledge. The Microsoft Digital Defense Report and CISA phishing advisories report on the trend regularly.

Characteristics of 2026 Phishing Campaigns

Flawless Turkish Powered by AI

In the past, broken sentences like "Dear customer your account has been blocked please click immediately" were a red flag. In 2026, this sign is mostly gone. The attacker has the text written by a model that has statistically memorized the style of a bank or e-Devlet. Local jargon, even the phrasing patterns in the organization's real email signature, are imitated. In other words, "the feel of the language" is no longer sufficient on its own.

Adversary-in-the-Middle (AiTM)

Evilginx2 and similar open-source kits set up a reverse proxy between the victim and the real service. The user enters their password and MFA code on the fake page; the kit simultaneously logs in to the real service and steals the valid session cookie. Classic SMS- or TOTP-based MFA can fall short against this attack. KrebsOnSecurity has documented AiTM campaigns many times over the last two years.

Vishing and Smishing

Vishing is social engineering done by phone. Smishing is over SMS. The 2023 MGM Resorts attack began with attackers calling the help desk and impersonating an employee, and it caused the company tens of millions of dollars in damage. The 2022 Uber breach was completed after a contractor employee's credentials were stolen, through MFA bombing (continuous approval requests) and a "we are from IT, approve it" message over WhatsApp. The most common smishing scenario in Turkey is a cargo notification: "Your package is on hold, pay the fee."

QR Phishing (Quishing)

Instead of a clickable link, a QR code image is placed in the email body. Most URL filters do not scan the QR within an image; the victim reads the code with their phone and is redirected to a malicious site on a personal device, outside the corporate security layers.

Brand Impersonation

Microsoft 365, Google Workspace, Yapi Kredi, Turkiye Is Bankasi, e-Devlet, KEP services, the tax office, and even USOM advisory notices are frequently imitated. Logos are copied pixel by pixel; the sender domain becomes a side domain like "microsoftsupport-tr.com."

A 12-Item Warning Sign Checklist

  1. Urgency language: "Your account will be closed within 24 hours," "final warning."
  2. Threat tone: a fine, a lawsuit, an account freeze.
  3. Link mismatch: the URL that appears when you hover differs from the written text.
  4. Sender mismatch: the display name is "Is Bankasi" but the actual address is @gmail.com or @isbankasi-guvenlik.com.
  5. Unexpected attachment: files with .zip, .htm, .iso, .one, or .img extensions.
  6. A request for an MFA code: No real organization asks you to type out your MFA code.
  7. A money transfer instruction: especially a "new IBAN."
  8. Unrecognized billing: "your subscription has been renewed, click to cancel."
  9. A request for personal data: national ID number, card CVV, mother's maiden name.
  10. An unsigned official letter: a real organization uses a signature block and a KEP reference number.
  11. URL shortening: bit.ly, t.co, and tinyurl links are not usual in corporate mail.
  12. HTTPS deception: do not assume it is safe because you see a green lock. The attacker also obtains a Let's Encrypt certificate.

Checking From the Email Header

You can see the raw header with the "Show original" option in Gmail or the "View message source" option in Outlook. The fields to look at:

  • From and Return-Path should show the same domain.
  • Received-SPF: should be pass.
  • DKIM-Signature should verify.
  • Authentication-Results: spf=pass dkim=pass dmarc=pass is the ideal. If one of the three is fail, that is an alarm.

For example, if the sender display name is "Google Security" but the Authentication-Results line reads dmarc=fail header.from=google.com, the email is almost certainly fake.

How to Check a URL

On desktop, hover the mouse over the link, and the real URL appears at the bottom left. On mobile, long-press the link. Paste the suspicious URL into a text editor and examine it. Three classic traps:

  • The subdomain trick: microsoft.com.evil-site.com actually belongs to the domain evil-site.com.
  • A homograph attack: the 'a' in the Cyrillic alphabet looks identical to the Latin 'a'; paypal.com may contain a Cyrillic character.
  • URL encoding: characters like %2F and %40 hide the real destination by breaking readability.

To analyze a suspicious URL without clicking it, search the PhishTank database, or run a sandboxed scan on urlscan.io.

What to Do When in Doubt

  1. Do not click the link, do not reply to the email, do not open the attachment.
  2. Instead of the link in the mail, type the organization's official site into the browser by hand.
  3. Verify out of band: find the organization's official number from its website and call it. The number in the mail may be fake.
  4. If it is work-related, forward it to the IT or security team; do not delete the email, forward it as an attachment.
  5. Report it to PhishTank and USOM.

"I Clicked, What Should I Do?"

Panic is not a solution. Act in order:

  1. Disconnect from the internet: take the device off the network.
  2. Change the password from another device: if you used the same password on other services, update all of them.
  3. Activate MFA: if you have none, set it up immediately; if you do, end the sessions and start them over.
  4. Check recent activity: review your bank, email, and social media activity.
  5. If it is a corporate device, notify IT: a digital forensics scan should be started.
  6. Monitor your email on Have I Been Pwned: if information was leaked, it appears here within a short time.

If the attachment was also opened and there are signs of ransomware, follow the steps in our The First 24 Hours After Ransomware article.

Corporate Protection Layers

SPF, DKIM, DMARC

Together, the three are the basic defense against email spoofing. You can check your domain's DMARC record on dmarcian. The target is p=reject. The transition is done in stages: first p=none (reporting only), then p=quarantine (to spam), and finally p=reject (full rejection). The Microsoft 365 and Google Workspace defaults do not set up these records for you; they must be configured manually.

Email Gateway and Sandbox

Solutions such as Microsoft Defender for Office 365, Proofpoint, Mimecast, and Trend Micro offer URL rewriting (re-scanning every link at the moment of the click) and attachment detonation (running the attachment in a virtual machine). At the SME scale, a start with Microsoft 365 Business Premium or Google Workspace Standard may be sufficient.

Employee Awareness Training

A slide presentation once a year does not work. Continuous simulation is needed. Platforms such as KnowBe4, Hoxhunt, Cofense, and Mimecast Awareness produce sector-based scenarios. The "click rate" metric, which measures whether the employee actually clicked, should decline over time.

Phishing Simulation Campaigns

Run a controlled test every three months. Send a micro-training module immediately to the user who clicks. A teaching approach rather than a punishing one produces lasting behavior change.

The Details of CEO Fraud and BEC

Business Email Compromise involves impersonating an executive and sending a fraudulent payment instruction to the finance unit. The most common variant is the "new IBAN" scenario: a supplier you have worked with for years supposedly changes its IBAN, and the payment goes to the attacker's account. The only solution is a hardened rule: an IBAN change is always verified through a second channel, by phone, from the supplier's known number. The number in the mail is not called.

Minimum 5 Controls for SMEs

  1. MFA on every account (preferably a hardware key or TOTP; SMS as the last choice).
  2. DMARC p=reject on the domain.
  3. An advanced protection plan on Microsoft 365 or Google Workspace.
  4. URL filtering at the DNS or browser level.
  5. Awareness training and a simulation for all employees at least twice a year.

Phishing Patterns Specific to Turkey

  • e-Devlet identity impersonation: "A lawsuit has been filed against you, log in for details."
  • A fake KEP invoice: a .htm attachment that looks like an e-invoice image.
  • The tax office: "You have a refund to receive, verify your IBAN."
  • USOM advisory forgery: "Abnormal activity on your account, download the report."
  • A bank SMS: it intensifies especially at year-end and during holiday periods.
  • A cargo notification: "The customs fee has not been paid." In 2026, its prevalence increased further with AI-generated, fluent Turkish text.

Reporting and Notification

Channels through which you can report a suspicious email or URL:

  • The USOM tip-off form (usom.gov.tr).
  • The PhishTank contribution interface.
  • The built-in "Report phishing" button in Microsoft Outlook and Gmail.
  • If you are a corporate entity, feed it to the SIEM/SOAR platform as an IOC (URL, hash, sender).

Case Examples (Publicly Known)

  • 2020 Twitter Bitcoin scam: Attackers tricked Twitter employees via vishing and accessed internal tools; they ran a Bitcoin scam from accounts such as Elon Musk and Barack Obama. Krebs wrote about it in detail.
  • 2022 Uber breach: After a contractor employee's credentials were leaked, entry was gained through MFA bombing and impersonating "IT" over WhatsApp.
  • 2023 MGM Resorts: The help desk was manipulated through vishing, and ransomware caused the company millions of dollars of damage per day.

All three cases teach the same lesson: even the strongest technical controls can fall short when a single link in the human chain is broken.

Frequently Asked Questions

My company is small, how do I prevent phishing?

First MFA, then DMARC, then employee training. Without these three, other investments remain ineffective. A hardware key (such as a YubiKey) costs about 50 dollars a year for executive accounts, and the return is very high.

Is MFA sufficient?

SMS-based MFA is weak against AiTM attacks. Prefer a hardware key (FIDO2/WebAuthn) or at least a TOTP app. A hardware key should be considered mandatory for executive and finance roles.

I opened a phishing email but did not click; am I infected?

In modern email clients, merely viewing it is generally harmless. But with remote image loading (image tracking), the attacker is informed that your email is active. To zero out the risk, mark it as "This is spam" and delete it.

I opened the attachment but did not say "allow"; is there a risk?

For .docx and .xlsx, if you did not press "Enable Editing," the macro did not run; the risk is low. With .htm, .iso, and .lnk files the risk is higher; notify IT and start an antivirus scan on the device.

The bank called and asked for my card information; is it real?

No. No real bank asks for your CVV, password, or SMS code by phone. Hang up and call the number on the back of your card.

A message came saying the IBAN changed; what should I do?

Always verify through a second channel. Call the supplier from the phone number you already know. Never call the number in the mail.

I have no budget for corporate training, what can I do?

You can put the free resources of CISA, USOM, and KrebsOnSecurity on the intranet. Even a 30-minute monthly session noticeably raises awareness. Sample emails from PhishTank are used to share real cases.

The Broader Context

Phishing, in the Turkey Cyber Threat Landscape 2026 picture, is a link in the same chain as ransomware, supply chain attacks, and data leaks. Most major incidents begin with a phishing email; this is why email defense is the unchanging first layer of a corporate cyber security strategy.

Working With DSET

As DSET, we support SMEs and mid-sized organizations in three packages: corporate DMARC consulting (including the none to quarantine to reject transition), a monthly phishing simulation campaign and employee awareness training, and an incident response retainer. Our office is at Hacettepe Teknokent, Ankara. For contact you can call +90 536 662 38 09 or fill out the form on dset.com.tr.

Sources: CISA Phishing Advisories, KrebsOnSecurity, PhishTank, Have I Been Pwned, dmarcian DMARC check, USOM.