How to spot a suspicious email

A guide for staff · about 6 minutes

Most security incidents in small businesses do not start with a technical weakness. They start with an email that looked normal and that someone opened in a hurry. This guide is written to be shared with your staff.

Why phishing works

Good attacks do not rely on a lack of intelligence, but on a lack of time. They manufacture urgency so that you act before you think: the invoice is due today, the account will be closed, the director needs something immediately. The busier you are, the better they work.

So the first rule is not technical: when an email puts you under time pressure, slow down. That pressure is itself the signal.

Seven checks, from the quickest to the deepest

1. The real sender address, not the name The displayed name can be anything. Click on it or expand the details to see the actual address. “National Bank <[email protected]>” is fake regardless of the name.
2. A domain that looks almost right Added or swapped letters are the most common technique: “microsoft-support.com”, “rn” instead of “m”, or a different ending such as .co instead of .com.
3. Where the link actually goes Hover over the link without clicking and read the address that appears at the bottom. On a phone, press and hold. If the text says one thing and the address says another, stop.
4. The type of attachment Be careful with .zip, .html and .iso files, and with documents asking you to “enable content” or “enable macros”. A genuine invoice rarely needs any of that.
5. Requests for credentials No serious institution asks for your password by email, and no bank asks for your verification code. The page it sends you to may look identical to the real one.
6. Were you expecting this email? An invoice from a supplier you don't work with, a delivery you never ordered, an unexpected refund — context that doesn't fit is a strong signal.
7. A change of bank account This is the most expensive case. A known supplier “notifies” you of a new account number. Always verify by phone, on the number you already have on file, never the one written in the email.

What to do when you are unsure

• Don't click and don't reply. Even a simple reply confirms that your address is active.
• Verify through another channel. Call the person on the number you know, not the one in the email.
• Report it. There should be an address or a person staff send suspicious emails to, without fear of being told off.
• If you have already clicked, say so immediately. Changing the password quickly and signing out of sessions limits the damage considerably.

What the business decides, not the employee

Training staff is half the work. The other half is the measures that make a mistake less expensive:

• Multi-factor authentication on email and on every system reachable from outside. Even if a password is stolen, it is not enough to get in.
• A verification procedure for payments. Every change of bank account is verified by phone by a second person.
• A reporting button or address that makes reporting a two-second job.
• Periodic simulations, not to catch people out, but to see where more explanation is needed.

In conclusion

Phishing does not require advanced technology; it only requires a moment of inattention. The best protection combines two simple things: staff who know where to look, and systems where one wrong click is not enough to open the door.