Phishing: how to recognise a fraudulent email (staff guide)

Most of a company's security problems do not start with a hacker breaking anything. They start with an email and a person in a hurry who clicks. Phishing, the email that pretends to be someone you trust in order to deceive you, is the number one way in. The good news: you can almost always spot it if you know what to look for. This guide is for sharing with your team.

What phishing is

It is an email (or an SMS, or a WhatsApp) that pretends to come from someone you trust: your bank, Microsoft, a supplier, even your own boss. The goal is for you to do one of three things: click a link, download a file, or hand over data or make a payment. It plays on haste and fear, because when you rush, you do not think.

The signs that give a fraudulent email away

• Urgency or threat. "Your account will be blocked in 24 hours", "invoice pending payment". They want you to act without thinking.
• The sender does not add up. Look at the real address, not just the name. An email from "Microsoft" from an odd domain is a red flag.
• Links that do not go where they say. Hover over them (without clicking) and see where they really point.
• Unusual requests. A boss asking by email for an urgent, confidential transfer. This fraud, the fake executive, costs companies dearly.
• Unexpected attachments. An invoice or delivery you were not expecting, in an attachment that asks you to "enable content".
• Errors and odd tone. Typos, strange translations or a generic greeting ("Dear customer").

What to do with a suspicious email

The golden rule: when in doubt, do not click and verify by another channel. If "your bank" or "a supplier" asks for something urgent, call the number you already know, not the one in the email. If it looks like a colleague or the boss, confirm in person or by phone. And tell your IT lead: if it reached you, it probably reached more people.

What really protects the company

Training people is the most cost-effective measure there is, because the human link is the one most attacked. But an email is not enough. What works is combining three things: email filtering that stops most attempts before they arrive, multi-factor authentication so a stolen password is not enough, and phishing simulations to measure and actually improve. That is part of our cybersecurity for businesses service, which includes awareness sessions with your team.

Frequently asked questions

How do I recognise a phishing email?

Be wary of urgency or threats, check the sender's real address, hover over links to see where they go, be suspicious of unusual requests for payments or data and of unexpected attachments, and watch for writing errors or generic greetings.

What do I do if I get a suspicious email at work?

Do not click or download anything, verify by another channel (call the number you already know or confirm in person) and tell your IT lead, because it has probably reached other colleagues.

Can phishing be avoided with training?

Training is key because it greatly reduces the risk, but it is best combined with email filtering, multi-factor authentication and regular simulations to measure and improve.