Show the URL: The tiny email UX fix that makes phishing harder
Details
Modern phishing often does not depend on badly spoofed emails anymore.
A message can pass the usual sender checks and still send you somewhere dangerous, simply because the real destination stays hidden until you hover or click.
This talk looks at that gap in email UX and argues for a simple default: show the URL.
We will walk through why sender authentication and safe-looking branding are not enough, how real phishing attacks exploit the mismatch between visible link text and the actual destination, and why exposing the true URL earlier can make suspicious messages much easier to spot.
The session also covers the practical side of the idea through Reveal URLs, the tool Jeroen built to make hidden destinations visible before you click.
This meetup is for everyone who has been victim of phishing or knows someone, but also developers, product people, security-minded engineers, IT professionals, and anyone interested in safer defaults in everyday software. You do not need to be a security specialist to follow it; the focus is on awareness, clear examples, practical reasoning, and a concrete UX improvement.
Jeroen is a freelance developer based in Alicante, building for the web since 1996, with a keen eye for security, and the creator of Reveal URLs.
Join us at ULab, Alicante on 22 July 2026 at 18:15 for a practical discussion about phishing, email design, and one small change that could make a meaningful difference.