As one who writes extensively on cybersecurity issues , specifically the rise of email phishing , I like to think of myself as more cautious than the average online denizen. But one recent Monday morning, I found the hard truth behind a common cybersecurity refrain: With attacks, it’s never a matter of if, but when.

Switching absentmindedly between my work and personal email accounts—both hosted on Gmail—I saw an order confirmation from Amazon.com. The email didn’t surprise me: the night before I was up doing a little online shopping before bed. But the confirmation still looked odd. Was that the item I ordered?