MISMATCHED DOMAIN
Display name claims legal entity, but domain uses spoofed address with capital 'I'.
ARTIFICIAL URGENCY
Strict deadline forces panic and immediate action before verification.
HIDDEN DESTINATION URL
Hyperlink text displays a legitimate action, but actual target points to an unsecure external server over HTTP.