Spam filters catch the obvious attempts. What gets through is the well written one: no attachment, no odd link text, just a plausible message from a name you recognise asking you to do something you do most days.
Here is what to check, in the order that catches the most.
1. The sending domain, not the display name
The name shown in your email client is chosen by the sender. It can say anything. What matters is the part after the @ in the actual address.
Look for a domain that is close but not right. A number one standing in for a letter i. A dot where there should be a dash. A real company name with an extra word after it. On a phone this is often hidden behind the display name, so you have to tap it to see.
2. Urgency
Almost every phishing email creates a reason to act now. Your password expires in two hours. The invoice is overdue. The payment has to go today or the order is cancelled.
That urgency exists for one reason: it stops you checking. When an email makes you feel rushed, that is the signal to slow down.
3. A request that breaks the normal process
Bank details that have changed. A payment that has to go by a different route. A file that has to be sent outside the usual system. A gift card bought urgently for a client.
Real businesses do occasionally change bank details. They do not mind you ringing to confirm it on a number you already had.
4. The greeting
Your IT team knows your name. So does your accounts contact at a supplier you have worked with for six years. Dear user, Dear customer and Dear sir or madam are all worth a second look in an email that claims to come from someone who knows you.
5. Where the link actually goes
Hover over a link on a computer, or press and hold on a phone, and the real destination appears. Compare it to what the text says.
Be particularly careful with buttons. A button can say anything and go anywhere, and it hides the address by design.
6. Whether you were expecting it
This is the simplest check and the one people skip. Were you expecting a delivery notification, an invoice, a password reset, a shared document? If not, the fact that it arrived at all is worth a moment of thought.
If you think you have clicked something
Tell someone straight away. Not in an hour, not after you have worked out whether it was really a problem.
The most damaging thing about a mistaken click is usually the delay between the click and somebody being told. An account can be locked and a password changed in minutes. What cannot be undone is the four hours an attacker had because nobody wanted to admit what happened.
That is worth saying out loud in your business, because people only report quickly when they are confident they will not be blamed.
Making it stick
Reading a list like this helps for about a week. What actually changes behaviour is seeing a convincing fake in a safe environment and getting a short explanation of what you missed.
That is what a phishing test and monthly training is for. If you want to see how your team does before spending anything, our baseline test is free.
