Paying attention to every detail, from the subject line, through the sender's domain, to the content of the message itself, which becomes suspicious if there is a request to send data or in cases where there are attachments.