Article · Cybersecurity
How to spot a phishing email in 10 seconds
The few red flags that catch most scams before anyone clicks.
Phishing emails are designed to look routine: an invoice, a shared document, a password expiring. You don’t need to be an expert to catch most of them. You just need to slow down for about ten seconds and check a few things.
1. Check who it’s really from
Look at the actual email address, not just the display name. “Microsoft 365 Support” sent from a random Gmail address or a misspelled domain like micros0ft-support.com is a giveaway.
2. Notice the pressure
Urgency is the scammer’s favorite tool. “Your account will be closed today,” “payment overdue,” or “the CEO needs gift cards in the next hour” are all meant to make you act before you think.
3. Hover before you click
On a computer, rest your mouse over a link without clicking. The real destination appears at the bottom of the window or in a small pop-up. If it doesn’t match where the email claims to send you, don’t click.
4. Be suspicious of sign-in pages
If an email link takes you to a page asking for your Microsoft password, close it. Instead, go to the site yourself by typing the address. Real problems will still be there when you sign in normally.
5. Verify payment changes by phone
Any request to change bank details, pay a new invoice, or buy gift cards should be confirmed with a phone call to a number you already have. Not the one in the email.
What to do if you clicked
Don’t be embarrassed, and don’t wait. Change your password, tell your IT team right away, and let them check whether anything else happened. A fast report turns a potential breach into a non-event.
Want your team trained to catch these? Ask us about security awareness training and simulated phishing.