How to Spot a Phishing Email

01What phishing looks like now

Phishing is no longer just badly spelled emails from a stranger. Today’s messages copy real invoices, shared-file notices, voicemail alerts and Microsoft 365 sign-in pages, and many come from a real account that was broken into, so they pass a quick glance.

The variants have their own names. Spear phishing targets one person using details from LinkedIn or your website. Business email compromise, or BEC, impersonates an owner or a vendor to redirect a payment. Smishing arrives by text, vishing by phone, and QR code phishing hides the link inside an image.

02Ten warning signs

• The display name is familiar, but the address behind it is not, or it is a free email account
• The reply-to address is different from the sender
• It creates urgency: an account about to close, a late invoice, a package on hold
• It asks you to change bank details, buy gift cards or keep the request quiet
• Hovering over a link shows a domain that does not match the company
• A shared file or voicemail asks you to sign in again to view it
• The attachment is an unexpected HTML, ZIP or macro-enabled Office file
• A QR code asks you to scan it with your phone to fix an account problem
• The greeting is generic, or the tone is off for the person it claims to be from
• It arrived out of the blue, even if it looks like it came from inside the company

03Check before you click

1. 01

   Pause

   Urgency is the attacker’s main tool. A genuine request will still be there after you take a moment to check it.

2. 02

   Inspect

   Look at the full sender address. Hover over links on a computer, or press and hold on a phone, to see where they really go.

3. 03

   Verify another way

   Call the person or company using a number from your own records, never one from the email itself.

4. 04

   Report it

   Use the Report button in Outlook, or forward the message to IT the way your company asks. Reports help block the next one.

04If you already clicked

Do not be embarrassed and do not wait. The people who report quickly are the ones who limit the damage, and a good IT team would always rather hear about a false alarm.

• Tell your IT support right away, and call if it seems urgent
• If you typed a password, change it and sign out of other sessions
• If you approved an MFA prompt you did not start, say so
• If money moved, call your bank at once and report it to the FBI at ic3.gov
• Keep the email: IT may need it to find and block similar messages

05How we help

Phishing defense works in layers. With ManagedITServices.Tech, Microsoft 365 spam and phishing filtering, security awareness training and phishing simulation come with every supported user, so filtering stops most messages and trained staff catch more of the rest. Endpoint MDR Plan I on each managed workstation watches for what happens after a bad click.

How managed cybersecurity works