How to Spot a Phishing Email (and What to Do)

What is phishing?

Phishing is a message that pretends to come from someone you trust, such as a bank, a delivery company, Microsoft, a supplier or even your boss, to trick you into clicking a link, opening an attachment, entering a password or sending money. It arrives by email, text message ("smishing"), phone call ("vishing") and social media.

Warning signs

• Urgency or fear: "Your account will be closed in 24 hours", "Unusual sign-in detected", "Payment failed".
• A sender address that's slightly off: look at the actual address, not just the display name. Watch for misspellings like rnicrosoft.com instead of microsoft.com.
• Links that don't go where they claim: on a computer, hover over a link (on a phone, press and hold) to preview the real address before tapping.
• Unexpected attachments, especially invoices, "shared documents", zip files or files that ask you to "enable content".
• Requests for passwords, codes or payment details. Real companies don't ask for these by email.
• Changes to payment details: "We've changed banks, please pay the new account." Always verify by phone using a number you already have.
• Generic greetings and odd wording, though modern phishing can be very polished, so don't rely on spelling mistakes.

The golden rule: verify another way

If a message asks you to act, don't use the links, phone numbers or reply address in the message. Open the app or type the website address yourself, or call a number you already know. Real organizations won't mind.

Fake tech support calls and pop-ups

A common scam is a pop-up or call claiming your computer is infected, asking you to call a number or let someone connect remotely. Microsoft, Apple and other companies do not call you out of the blue about viruses.

What to do if you clicked

1. Don't panic, but act quickly.
2. If you entered a password, change it right away from a trusted device, and change it anywhere you reused it.
3. Turn on two-factor authentication on that account.
4. If you downloaded or opened a file, disconnect the device from the internet and run a security scan, or contact IT support.
5. If you gave out bank or card details, call your bank immediately using the number on your card.
6. At work, tell your IT contact straight away. Reporting quickly limits the damage.

Make yourself a harder target

• Use a password manager. It won't fill in your password on a fake site.
• Turn on two-factor authentication everywhere you can.
• Keep your devices and browsers up to date.
• Train your team regularly. We offer security awareness training.