How to spot a phishing email before it's too late

Phishing — fraudulent emails designed to trick you into handing over passwords, money, or access — is still the number one way businesses get compromised. The attacks have gotten more convincing, but they almost always carry tells. Train yourself and your team to spot these, and you'll stop most of them cold.

Why it matters

A single employee clicking one malicious link can lead to drained accounts, stolen client data, or ransomware. Attackers count on people being busy and clicking on autopilot. The defense is simple: slow down and verify before you act.

The red flags

1. A sense of urgency or fear

"Your account will be closed in 24 hours." "Unusual login detected — verify now." Urgency is designed to make you act before you think. Legitimate organizations rarely threaten you into instant action.

2. A mismatched or odd sender address

The display name might say "Microsoft," but the actual address is something like security@micros0ft-support.co. Always check the real email address, not just the name.

3. Links that don't go where they claim

Hover over a link (don't click) to see the true destination. If the text says one thing but the URL points somewhere unfamiliar, that's a major warning sign.

4. Unexpected attachments

Invoices, shipping notices, or "voicemails" you weren't expecting — especially as .zip, .htm, or files asking you to "enable content" — are classic malware delivery methods.

5. Requests for credentials or payment

Be deeply suspicious of any email asking you to log in via a link, change banking details, or buy gift cards — even if it appears to come from your boss or a vendor. This "business email compromise" tactic costs companies billions every year.

6. Small mistakes

Awkward grammar, generic greetings ("Dear Customer"), or slightly-off logos often betray a fake, though polished attacks exist too.

What to do if you clicked

• Don't panic, but act quickly.
• Disconnect the device from the network if you downloaded or ran anything.
• Change the affected password immediately (from a different device) and enable MFA.
• Tell your IT provider right away — fast response dramatically limits the damage.

Build the habit

The best protection is a team that instinctively pauses on anything unusual. Pair that with email filtering, MFA, and a clear "when in doubt, report it" culture. If you'd like help training your team or tightening your email security, we can put those safeguards in place for you.