A practical checklist for alias-aware phishing checks

Before you share the address

Pause at the point where a supposed bank warning arrives at an address used only for shopping. Ask whether the relationship is temporary, whether recovery matters and what would happen if the address became public.

The checklist

• Check the receiving address
• Ignore urgency
• Open the service directly
• Report suspicious messages

Write down the purpose beside the credential. A label is small operational memory: it prevents a random-looking address becoming another mystery.

After the first message arrives

Confirm that the route works, that replies behave as expected and that important mail is not being forwarded somewhere unsafe. If the relationship grows, extend the lifetime before it becomes urgent.

Review without over-managing

Use the receiving alias as one clue and verify important requests through a known route. Review on change—not every day. A message sent to the correct alias can still be fraudulent after a breach.