Spotting Phishing Emails: How To Tell In Five Seconds
Six signals that give away almost every phishing message, what to do the moment you spot one, and what to do if you already clicked.
In short: six signals give away almost every phishing email, and the first is that the sender address does not match the display name. The aim is not to become suspicious of everything, it is to know the small number of signals an attacker cannot easily fake. Verify any request to move money or change bank details by a second channel, every time.
Phishing is still how most business breaches start, and it is not because people are careless. It is because a good phishing email is designed to look exactly like the hundred legitimate emails you have already read today.
Spotting Phishing Emails: The Six Signals That Matter
1. The address does not match the name. The display name is free text and an attacker can set it to anything, including your CEO. Click or hover on the sender and read the actual address. A message from your bank that arrives from a personal mail domain is finished right there. Watch for near misses too, where a single letter is swapped or an extra word is added to a domain you know.
2. It creates urgency you did not expect. Invoices that must be paid today, accounts that will close in an hour, a manager who needs gift cards before a meeting. Urgency is the tool that stops you checking. Any message that combines time pressure with a money or credential request deserves a second look regardless of who it appears to come from.
3. The link text and the link destination disagree. Hover over a link without clicking and read the address your browser shows. If the text says one company and the destination says another, or the destination is a long string of characters on a domain you do not recognize, stop.
4. It asks you to log in to see something. A shared document, a voicemail, a delivery notice, a fax. The attachment is often a picture of a login box or a link to a convincing copy of a real sign in page. Legitimate services rarely need you to enter a password to view something you were expecting.
5. Something about the request is slightly out of pattern. A supplier who has invoiced the same way for three years suddenly sends new bank details. A colleague who always writes two lines sends four paragraphs. Changed payment details are the single most expensive form of this attack, and they are almost never legitimate on first request.
6. It is a reply to a conversation you do not remember having. Attackers who have compromised somebody else’s mailbox will reply into a real thread, quoting real history, from a lookalike address. This is the hardest one to catch, and it is why verifying by a second channel matters more than reading carefully.
What To Do When You Spot One
Do not reply, do not click, and do not forward it to a colleague to ask what they think, because that is how one suspicious email becomes five people at risk.
Report it. If your mailbox has a report button we configured, use it, because that route sends the message to us with its full technical headers intact. If it does not, open a ticket and attach the message rather than pasting the text, again because the headers are what let us trace whether anyone else received it.
Then leave it alone. Deleting a phishing email feels productive but it removes the evidence we need to check whether it reached anyone else in your organization.
Verify By A Second Channel, Every Time
The single habit that prevents the most expensive incidents is this one. If an email asks you to move money or change payment details, confirm it by a different channel than the one the request arrived on.
That means calling the person on the number you already have for them, not the number in the email signature. It means walking to their desk if they are in the building. It does not mean replying to the message to ask if it is genuine, because if the account is compromised the attacker is the one who answers.
Make this a written rule rather than a personal habit. When finance has explicit permission to slow a payment down and make a phone call, nobody has to weigh being careful against looking difficult. Spotting phishing emails early is the cheapest security control any business owns.
If You Already Clicked
Tell us immediately. Not tomorrow, not after you have worked out how bad it is. The gap between a click and a report is the window an attacker gets to use, and it is usually measured in minutes rather than days.
You are not in trouble. Every organization that has ever tested this finds that capable, careful people click convincing phishing emails, and treating a report as a mistake is the fastest way to teach everyone to stay quiet. What we need from you is speed.
If you entered a password, change it, and tell us which other accounts share it. If you approved a multi-factor prompt, say so, because that changes what we look for. If you opened an attachment, leave the computer on and connected but stop using it, and call 678-374-4352. Powering off can destroy evidence that helps us establish what actually happened. If your team can spot a phishing email in five seconds, most attacks never get started. Most people get good at spotting phishing emails once they have seen three real examples.
Phishing Questions We Get Asked
What our clients ask after the first suspicious message lands.
Yes, provided the goal is measurement rather than punishment. Simulations tell you which departments and which message types need attention, and repeated over a year they reliably reduce click rates. They stop working the moment people believe a click will be held against them.
It catches the bulk of them. The messages that get through are the targeted ones, written for your company, sometimes sent from a genuine compromised mailbox at a supplier you actually work with. Filters are necessary and they are not sufficient, which is why the habits on this page matter.
The same attack moved to another channel, and it is growing quickly. A text claiming to be your manager asking for a favor, or a caller claiming to be from your bank or from your own IT provider. We will never call and ask you for your password or for a multi-factor code. Nobody legitimate will.
Largely, yes. Correctly configured SPF, DKIM and DMARC records tell the rest of the world which servers are allowed to send as your domain and what to do with messages that fail. Most companies have these records partly configured or not at all. It is a short project with a real return and we can audit yours.
Immediately, and before you investigate. A report that turns out to be nothing costs us a few minutes. A report that waits until the end of the day can cost significantly more than that.
How To Spot Phishing Emails On Your Phone
Most of the six signals are harder to check on a phone, which is exactly why so many phishing emails get opened on one. The screen shows the display name and hides the address, and there is no mouse to hover over a link.
Tap the sender name to see the real address. Press and hold a link, rather than tapping it, to preview where it goes. If that feels like too much effort, leave the email until you are back at a computer. A real request will still be real later.
If a phishing email reaches you on your phone and you are unsure, do nothing with it. Report it from your computer, or call us.
Phishing Email Tricks That Get Past Careful People
Lookalike domains. One changed letter, an added hyphen or a different ending such as .co instead of .com. Read the address slowly, because your eye fills in what it expects to see.
Real services carrying fake requests. A phishing email can come from a genuine file sharing or e-signature service, because attackers open free accounts on them too. The sender is real; the request is not.
Timing. These messages arrive at the end of the day, before a holiday, or when the person being impersonated is known to be traveling. Feeling rushed is part of the design.
Knowing how to spot phishing emails is mostly knowing these patterns exist. Once you have seen each one, the next phishing email that uses it stands out.
When Spotting Phishing Emails Is Not Enough
Some phishing emails are good enough to fool anyone, and some attacks skip email entirely and use a phone call or a text. Spotting phishing emails is the first layer, not the only one.
That is why the other layers matter: email filtering, multi-factor authentication and a fast way to report. If one gets through and someone clicks, those layers buy time.
If you think a phishing email got through, call 678-374-4352 and press option 1. If someone already clicked, follow what to do if you clicked a phishing link.
Think An Email Got Through To Someone?
Call 678-374-4352 and press option 1. Our security team would far rather look at ten false alarms than miss the one that mattered. Learning to spot a phishing email is the single cheapest security control a business has.
CISA keeps a current public reference on recognizing and reporting phishing, and it is worth sharing with your whole team. Spotting phishing emails is a habit, not a talent, and it can be taught in an afternoon.