🎣 How to Spot Phishing Emails
Phishing emails are getting sneakier, but there are still telltale signs you can spot. Here's how to protect yourself and your business.
The Classic Red Flags
Most phishing emails share common characteristics:
- Urgency and threats - "Your account will be closed!" or "Immediate action required!"
- Generic greetings - "Dear Customer" instead of your actual name
- Suspicious sender addresses - paypa1.com instead of paypal.com (notice the "1")
- Requests for personal information - Real companies never ask for passwords via email
- Poor spelling and grammar - Professional companies proofread their emails
The Clever New Tricks
Modern phishing attacks are more sophisticated:
- Look-alike domains - microsoftonline-secure.com looks legitimate but isn't
- Spoofed display names - The name says "Microsoft" but hover over the email to see the real address
- Realistic logos and branding - They copy company designs perfectly
- Context-aware attacks - They know you use certain services and target you specifically
What to Do Instead
- Hover before you click - Hover your mouse over links to see where they really go
- Go direct - Don't click email links. Type the website address yourself
- Enable MFA - Even if someone gets your password, they can't get in without your second factor
- Report suspicious emails - Forward them to your IT team or use your email provider's report feature
- When in doubt, call - If an email seems odd, call the company directly using a number you find yourself
Pro Tip: Your bank, the tax office, and tech companies will NEVER ask you to click a link in an email to verify your account. They just won't. If you see that, it's a scam.
Remember: It's better to be overly cautious than to fall for a scam. Delete suspicious emails and move on. No legitimate company will punish you for being security-conscious.
Need help tightening security?
We help small teams secure Microsoft 365, harden identities, improve backups, and reduce risk without overcomplicating the setup.