1. Manufactured urgency
A deadline exists to stop you checking. Real organisations give you time and a way to verify. If a message makes your stomach drop, that is the tell — slow down deliberately.
2. Irreversible payment
Gift cards, crypto, and wires cannot be reversed. That is exactly why they are requested. No government, bank, or utility has ever asked for a gift card.
3. Requested secrecy
"Do not tell your partner / your manager" removes the one person likely to spot it. Secrecy is not a feature of legitimate business.
4. The code read aloud
Reading a one-time code to a caller is handing over the account. No support desk will ever ask for it — not once, not for verification.
5. The near-miss address
paypal-secure-support.com is not PayPal. Only the last two parts of a domain matter; everything before them is decoration an attacker chooses.
Takeaway. You can paste any of these into the free Exposure Center and get a reason, not just a verdict.