A convincing phishing email rarely looks like the old-fashioned scam messages full of spelling mistakes. It may appear to come from Microsoft, your bank, a supplier, a charity colleague or even your own director. Learning how to spot phishing emails is less about becoming suspicious of everything and more about knowing which small details deserve a pause.
For a small business or charity, that pause can prevent a stolen password, a fraudulent payment or a locked computer at the worst possible time. The good news is that you do not need to be an IT specialist to make safer decisions. A calm, repeatable check is usually enough.
How to spot phishing emails: start with the request
Do not begin by judging the logo or the layout. Criminals can copy both very well. Start with what the message wants you to do.
Phishing emails commonly push you to sign in, open an attachment, pay an invoice, change bank details, share information or buy something quickly. None of those actions is automatically unsafe, but urgency is often the giveaway. A message claiming your account will be closed in 30 minutes, that a payment must be approved immediately, or that the chief executive needs gift cards before a meeting is designed to rush your judgement.
Take a breath and ask: would this person or organisation normally ask for this by email? Is the timing believable? Can I confirm it another way? A genuine request can usually wait for a quick phone call, Teams message or conversation with the sender using contact details you already trust.
This is especially useful for payment requests. If a supplier says their bank details have changed, do not reply to that email to check. Call the number you have on file or from a previous legitimate invoice. A compromised supplier account can send very believable messages, so a familiar name alone is not proof.
Check who really sent it
The display name at the top of an email is easy to fake. What matters is the full email address behind it.
A message may say it is from “Microsoft Support” while the actual address ends in a completely unrelated domain. Other scams use lookalike spellings, such as replacing a letter with a number or adding an extra word: `accounts@micros0ft-security.example` rather than a genuine business address. On a phone, you may need to tap the sender’s name to reveal the full address.
Be alert, but do not assume every unusual-looking address is a scam. Some organisations use external mailing services, and smaller suppliers may have a different domain from the name you know. The key is whether it makes sense in context. If it does not, verify independently before acting.
Reply addresses matter too. An email can appear to come from a colleague but send replies somewhere else. If you hit Reply and the address changes to one you do not recognise, stop there.
Treat unexpected attachments with care
An attachment can be genuine and still be dangerous. An invoice, delivery note, CV or shared document is a common route because it looks routine in a busy office.
Be particularly cautious if you were not expecting a file, if the email gives little explanation, or if the attachment has an unusual type. Files ending in `.exe`, `.js`, `.zip` or `.html` deserve extra scrutiny. Microsoft Office files that ask you to “enable content” or “enable macros” should also raise a red flag. In most everyday work, there is no good reason to enable macros in a document sent unexpectedly.
A PDF is not automatically safe either. If an email says “view document” and the attachment or button takes you to a sign-in page, treat it as a possible password-stealing attempt. Confirm with the sender first.
Hover before you click
Links are where many phishing emails do their damage. The visible words may say “View invoice” or “Sign in to Microsoft 365”, but the actual destination could be somewhere entirely different.
On a computer, hover your mouse over a link without clicking it. Most email programs show the web address near the bottom of the window. On a mobile, press and hold the link carefully to preview it. Look for misspelt names, odd domains and long strings of random characters.
A safe-looking beginning does not guarantee a safe destination. For example, `microsoft-login.example.co.uk` is not a Microsoft address simply because the word “microsoft” appears at the start. The important part is the actual domain near the end, before any final extension such as `.co.uk` or `.com`.
If you receive a message from a service you use, the safer habit is to open the service yourself from your normal bookmark or app, then check for notifications there. This takes a few extra seconds and removes the risk of following a disguised link.
Watch for pressure, secrecy and unusual tone
Phishing works because it targets normal human reactions: wanting to be helpful, avoiding trouble and getting a task off the list. The language often creates pressure or secrecy.
Watch for messages that ask you to keep a request confidential, bypass the usual approval process, or act while someone is travelling and cannot be contacted. A supposed manager asking a member of staff to buy gift cards is a classic example. So is a request to send payroll details or customer information “just this once”.
Tone can help, although it is not a reliable test on its own. An email from a colleague that suddenly sounds formal, vague or unlike them may be suspicious. Equally, modern scams can be well written, particularly when criminals use copied messages or automated writing tools. Good grammar is not a safety certificate.
Look out for QR codes and fake sign-in pages
QR codes are increasingly appearing in phishing emails because they encourage you to switch from a work computer to a personal phone. The code may claim to let you view a document, renew a password or complete security checks. Once scanned, it can lead to a fake sign-in page that steals your account details.
Do not scan a QR code in an unexpected email. If the request might be genuine, go directly to the relevant service instead.
A fake sign-in page can look almost identical to a real one. Before entering your password, check the address bar carefully. Also notice whether the page asks for more than usual, such as your password, recovery details and a one-time code all at once. Never approve a multi-factor authentication prompt you did not initiate yourself. That approval can be the final step a criminal needs.
Use a simple three-step check
When an email creates even a small sense of doubt, use this routine before clicking, replying or forwarding information:
- Pause. Do not let an urgent subject line make the decision for you.
- Inspect. Check the sender address, the request, any attachment and the link destination.
- Verify. Contact the person or organisation using a trusted phone number, saved contact or a separate new message.
It is better to verify a real email than to apologise after responding to a fake one. Legitimate suppliers, colleagues and banks understand that security checks are part of doing business sensibly.
What to do if you think an email is phishing
If you have not clicked anything, report the message through your email program’s phishing or junk reporting option, then delete it. If it claims to be from a known organisation, you can forward it to that organisation’s fraud-reporting address if one is provided through its official channels. In the UK, suspicious emails can also be reported to the National Cyber Security Centre’s Suspicious Email Reporting Service.
If you clicked a link but did not enter any details, close the page and let your IT support provider know. They can check whether anything else needs attention. If you entered a password, change it immediately from the genuine service site, not from the email link. If you use that password elsewhere, change those accounts too, starting with email, banking and other important services.
If money, bank details or sensitive personal information may have been shared, contact your bank promptly and tell the relevant people in your organisation. Speed matters here, but there is no need for panic. Clear information about what happened, when, and what was clicked helps support teams respond effectively.
Make phishing harder to succeed
The strongest protection is a team that feels comfortable asking questions. Make it normal for staff and volunteers to check unusual requests, particularly payments and changes to personal data. Nobody should be embarrassed for pausing a task that looks wrong.
Use a different, strong password for every important account and turn on multi-factor authentication wherever it is available. Keep devices and software updated too, since updates fix known weaknesses that criminals may exploit. These steps will not stop every phishing email from arriving, but they can greatly reduce the harm if one slips through.
Most phishing attempts rely on you feeling rushed, isolated or unsure. Give yourself permission to slow the moment down. A quick independent check is not being difficult – it is good business practice, and it keeps the people and information you look after safer.