Phishing works by creating pressure. A message claims your account will close, a delivery failed, or a payment needs confirming, and the urgency is designed to stop you checking anything.
Modern attempts are well written and visually accurate, so the old advice about spelling errors is no longer enough. The reliable checks are structural: who actually sent it, where the link really goes, and whether the request makes sense.
Text messages and calls now carry as much of this as email, and caller ID can be faked, so a convincing phone call is not proof of anything.
The safest habit is to never act from the message itself. Open the app or type the address you already know, and see whether the same alert exists there.