Phishing emails are designed to look routine: a shared document, an overdue invoice, a password expiring. They work because they arrive while you’re busy. The good news is that a short pause and a few checks will catch the large majority of them.
The 30-second check
- Look at the sender’s actual address, not just the display name. “Microsoft 365” sending from a random domain, or a vendor’s name with one letter off, is a red flag.
- Hover over links before clicking. On a computer, hover your mouse over a link to see where it really goes. On a phone, press and hold. If the address doesn’t match the company, don’t click.
- Notice pressure. “Urgent,” “final notice,” “your account will be closed today”: urgency is designed to rush you past your instincts.
- Be suspicious of unexpected attachments, especially zipped files, HTML attachments, or documents that ask you to “enable content.”
- Treat money and login requests with extra care. Requests for gift cards, wire transfers, or changes to banking details should always be verified by phone using a number you already have, not one in the email.
A good rule: if an email asks you to log in, don’t use the link. Go to the site directly or use your bookmark.
Watch for fake login pages
Many phishing attacks lead to a page that looks exactly like the Microsoft 365 or Google sign-in screen. Check the address bar carefully before typing a password. Multi-factor authentication helps, but attackers now try to capture MFA codes too, so a convincing page is still dangerous.
Already clicked? Act fast.
- Tell your IT provider immediately. There is no need to be embarrassed. Minutes matter.
- If you entered a password, change it right away from a known-good device.
- If you approved an MFA prompt you did not expect, report it. Someone else may have your password.
- Don’t forward the email to coworkers. Let IT handle it.
Regular, short security training and simulated phishing tests keep these habits sharp across your whole team.