How to Spot a Phishing Email: 10 Warning Signs

Phishing remains one of the leading entry points for cyberattacks on businesses. A single click is enough to hand over a password, install malware or trigger a fraudulent transfer. Knowing how to spot a phishing email is therefore an essential reflex for every employee.

Fraudulent emails are increasingly polished: spelling mistakes are no longer enough to identify them. Here are the 10 signs that should alert you.

The 10 warning signs

1. The sender’s address doesn’t match

The display name says “Customer Service” or the name of a colleague, but the actual address comes from another domain. Also watch out for domains that imitate the real one, such as “micros0ft-support.com”.

2. A sense of urgency or threat

“Your account will be suspended within 24 hours”, “final notice before legal action”: urgency pushes you to act without thinking. It is the main lever of phishing.

3. An unusual request for money

An urgent, confidential transfer, a change in a supplier’s bank details, a request to buy gift cards. These requests are typical of CEO fraud and fake supplier fraud.

4. A link that doesn’t go where it claims

Hover over the link with your mouse without clicking, or long-press it on mobile. If the address shown doesn’t match the expected site, don’t click.

5. A page asking for your credentials

An email that sends you to a login page to “verify” your account is suspicious. Legitimate services never ask for your password or two-factor code by email.

6. An unexpected attachment

An invoice you weren’t expecting, a compressed file, a document asking you to “enable content” or macros: don’t open anything without checking with the sender through another channel.

7. A generic message

“Dear customer”, “Hello user”: a service you have an account with usually knows your name.

8. An offer too good to be true

A prize from a contest you never entered, an unexpected refund, a parcel held for a small fee: these scenarios are designed to steal your bank details.

9. A hijacked conversation

An attacker who has compromised a mailbox can reply within a real email thread. A sudden change in tone, request or bank details in a familiar exchange should alert you.

10. A QR code to scan

“Quishing” hides the malicious link in a QR code, which email filters struggle to analyse. An email asking you to scan a QR code to log in is suspicious.

The right reflexes

• Don’t click and don’t reply if in doubt.
• Check through another channel: call the sender on a number you already know, never the one given in the email.
• Report the message to your IT department, using your mailbox’s report button if there is one.
• Report it online as well: in France, use Signal Spam for emails, or forward fraudulent text messages free of charge to 33700. Most countries have similar reporting services.

You clicked? Here’s what to do

1. Alert your IT department immediately, without deleting the message.
2. If you entered a password, change it right away, along with any other accounts where you use it.
3. If you gave out bank details, contact your bank to block your card.
4. For help in France, the public platform Cybermalveillance.gouv.fr supports individuals and businesses.

Two protections that make all the difference

Two-factor authentication prevents an attacker from using a stolen password on its own.

A password manager won’t autofill your credentials on a fake site, because it doesn’t recognise the address: it is an excellent phishing detector.