How to spot a phishing email before it is too late

Why phishing still works

Phishing is an attack where criminals pretend to be someone you trust to trick you into clicking a link, opening a file or sharing information. It is still the most common starting point for data breaches and ransomware attacks around the world.

It works because it targets people rather than technology. Even the best firewall cannot stop an employee from typing their password into a convincing fake page. With AI tools, attackers can now write perfect, personalised emails in any language, so the old advice to look for spelling mistakes is no longer enough.

Check the sender carefully

Attackers use addresses that look almost right, like support@paypa1.com or billing@micros0ftsupport.com. Email apps often show only the display name, which can say anything. Always look at the full email address behind the name.

Be extra careful with messages that seem to come from your own boss or a colleague but arrive from a personal Gmail account or an unusual domain. This trick, called business email compromise, costs companies billions every year.

Be suspicious of urgency and pressure

Phishing emails are designed to make you act before you think. They often say your account will be closed today, a payment has failed, a parcel cannot be delivered or the CEO needs an urgent bank transfer.

Whenever a message creates pressure, slow down. Verify the request through another channel, such as calling the person on a number you already know. A real colleague or company will never mind you double checking.

Look before you click

On a computer, hover over a link to see where it really goes before clicking. On a phone, press and hold the link to preview it. If the address does not match the company it claims to be from, do not open it.

Never enter a password on a page you reached from an email link. Instead, open the website yourself by typing the address or using a bookmark.

• Unexpected attachments, especially ZIP files or documents asking you to enable macros.
• Requests for passwords, one time codes or payment details.
• Generic greetings like Dear Customer from a company that knows your name.
• Offers that seem too good to be true, like prizes you never entered for.
• QR codes in emails that lead to login pages.

What to do if you clicked

Mistakes happen, even to careful people. What matters is acting fast. If you entered a password, change it immediately on the real website and on any other site where you used the same password. Turn on two factor authentication if it was not already active.

Tell your IT team or manager straight away, even if you feel embarrassed. A fast report gives the team time to block the attacker before real damage is done.

Build a culture of reporting

Technology helps, but people are the strongest defence. Run short training sessions a few times a year, share real examples and give everyone a simple way to report suspicious emails with one click.

Thank people when they report something, even if it turns out to be harmless. A team that feels safe asking questions will catch attacks that no filter can.