A sender address that doesn’t match the real company. Urgent threats (“your account will be closed”). Generic greetings like “Dear customer.” Links whose real address differs from the text (hover…