People who know how to spot and avoid phishing attacks do these 7 things well:

1. They check links before clicking
2. They check the sender if they suspect something is off
3. They can spot the red flags in the content (grammar and spelling errors, strange requests, etc.)
4. They’re reluctant to sharing confidential information via email
5. They don’t overshare personal information on social media
6. They never enable macros in Microsoft Office
7. They use antivirus and other security solutions to keep them safe.

Read more here: https://www.alienvault.com/blogs/security-essentials/the-seven-habits-of-highly-un-phishable-users