Phishing emails rush you into handing over passwords or payment details. Eight practical warning signs help you recognise suspicious messages and respond the right way.
Phishing is when attackers try to obtain passwords, payment details or company information through an email, message or fake sign-in page that looks trustworthy. At first glance the message may appear to come from your supplier, your bank or your manager. The goal is not to distrust every email, but to build a habit of quick verification for messages that ask for money, passwords or files.
Look at how the message is steering you
Phishing attempts often try to cut short your thinking time. Phrases such as "confirm now", "your account will be closed" or "pay today" are not proof on their own, but they should be weighed together with other signs. Even if a request resembles a genuine business process, verify the unusual part through a different channel.
Eight warning signs
1. The sender's name is familiar, but the address is not
The name your email program displays proves nothing by itself. Open the full address and check the domain after the @ sign. A swapped character (for example "1" instead of "l"), an extra word or an unrelated domain can indicate that the message did not come from the real source. Even if the address looks entirely correct, the sender's account may have been compromised, so the other signs matter too.
2. It creates urgency or fear
Fraudsters create a sense of urgency so that you skip the usual approval steps. Topics such as payments, deliveries or account closures can seem convincing. If the request really is important, contact the other party using a known phone number or a channel you have used before.
3. The link goes somewhere else
Before clicking, hover over the link with your mouse (or press and hold on mobile) and check the real address. A company name in the link text does not mean the link leads to that company. If in doubt, don't use the link; type the service's address into your browser yourself or use your saved bookmark.
4. It asks for a password or verification code
If a message asks for your password, verification code or card details, stop. Even if the service genuinely needs you to update your details, go to the sign-in page by a route you know and trust, not through the link in the message.
A one-time verification code is as sensitive as your password. Legitimate support teams generally do not ask you for it; if someone claiming to be from support does, don't share the code and confirm the request through an independent channel.
5. It has an unexpected attachment
Attachments that look like invoices, CVs, shipping documents or file-sharing notifications can be malicious. Be careful with archive files you were not expecting (such as ZIP or RAR), executable files, and documents that ask you to "enable content" or turn on macros. Even for an unexpected attachment from someone you know, make a quick call to a number you already have for them.
6. The tone and context are unusual
Spelling mistakes are not a reliable test on their own; there are perfectly written fake emails too. The real question is whether the message reflects your relationship with the sender and your normal workflow. A payment request that would normally be handled by the purchasing team but comes from someone else deserves investigation.
7. The payment account has changed
If a supplier's bank account or the payee details on an invoice have changed, don't settle for a reply by email. Call the relevant person on the number in your contract or your own records; the number in the email signature could be fake as well. Make this check a standard step in your payment process.
8. The sign-in page or approval request is unexpected
Fake pages can copy the sign-in screen of a familiar service exactly. Check the domain in the address bar; the padlock icon only shows that the connection is encrypted, not that the site can be trusted. If an app asks for access to your email or files and you did not initiate the request, don't approve it. A verification prompt for a sign-in you did not start is also a warning sign; rather than approving it, ask for support.
When you come across a suspicious message
If you have not clicked the link or opened the attachment, forward the message to your organisation's designated reporting channel. Noting the sender and subject helps find similar messages. If you clicked or entered information, don't keep it to yourself: ask for support straight away to change your password from a trusted device, sign out of open sessions and review the affected accounts. If you shared card or bank details, contact your bank without delay as well.
Build a culture of verification
The strongest habit against phishing is to pause and verify an unexpected request. For this to work, managers must follow the same rule: a manager should not ask staff for gift cards, bank details or passwords in an unusual way, and even urgent matters should go through a second channel. If staff who verify feel they are slowing things down, the time pressure attackers rely on becomes more effective.
Agree in advance on a verification route and a second-person approval for payment account changes, urgent transfers and sharing sensitive documents. That route should never be calling back the number in the email; it should use independent contact details recorded in the contract, customer record or company directory. That way, a suspicious request is never processed on one person's decision alone.
When an employee reports that they clicked a link, don't react with blame. Early reporting creates the chance to reset passwords, review sessions and warn other users about the same message. The aim is not to find fault but to limit the damage.
Technology and process work together
Email filters, link scanning and multi-factor authentication are useful layers that support the user's judgement, but they do not replace a careful habit of verification. Review these tools' settings regularly, and explain to staff that a message that gets past the filter can still be fake. In shared mailboxes and sensitive areas such as finance and HR, it should be clear who follows up on which alert.
Set up a single reporting channel for suspicious messages and send a short acknowledgement when a report comes in; this encourages people to keep reporting. Sharing real examples with the team from time to time makes awareness concrete: which sign was spotted, and what was the right response? When sharing, remove any personal or sensitive information from the messages.
Checklist
- Are the sender's display name and full email address checked together?
- Are unusual requests for money or information verified through another channel?
- Can users check where a link leads before clicking?
- Is the sender contacted before unexpected attachments are opened?
- Has it been made clear that passwords and verification codes must not be shared?
- Is there a second verification step for payment account changes?
- Do people know the channel for reporting suspicious emails?
- Is there a culture that lets people who make a mistake ask for help quickly?