Phishing emails are everywhere. But what happens when you are the target? This presentation is about a real life phishing incident I experienced as a student at London South Bank University and the findings I uncovered during my investigation.I noticed some suspicious activity and rather than just delete it, I thought I’d dig a little deeper. I’m quite proud of what I uncovered about the spoofed sender, the social engineering tricks they employed and the infrastructure behind it all - which I reported to the university IT team.In this discussion we will cover how the phishing attack bypassed SPF, DKIM and DMARC, the investigation process using open source tools, subtle red flags that may be overlooked, and practical tips to detect and respond to phishing attacks.