How to Spot a Phishing Email Before Someone Clicks
When a small business gets hit with ransomware or a fraudulent wire transfer, it rarely starts with anything technical. It starts with an email that looked normal enough that someone clicked a link, opened an attachment or replied with information they shouldn't have.
Spam filters catch a lot, but not everything. The best defense is a team that knows what to look for. These are the warning signs we walk our clients' staff through.
The sender name and the actual address don't match
An email can say it's from your bank, a vendor or your own boss, and the display name will show exactly that. The address behind it is what matters. Look for small misspellings, extra words in the domain, or a free Gmail or Outlook account pretending to be a company.
It's urgent, and it wants you to skip a step
"Your account will be suspended today." "I'm in a meeting, I need this wire sent before 3." "Can you pick up some gift cards for a client? Keep it between us." Pressure is the point. Scammers want you to act before you stop and think.
The link goes somewhere unexpected
On a computer, hover over a link before clicking and look at the address that appears. If an email claims to be from Microsoft and the link points to an unfamiliar site, don't click it. When in doubt, go to the website directly instead of using the link.
There's an attachment you weren't expecting
Fake invoices, shipping notices, voicemail recordings and "shared documents" are all common ways to deliver malware. If you weren't expecting it, check with the sender by phone or a separate email before opening it.
Someone is asking to change payment details
This one costs businesses real money. A vendor suddenly has a new bank account, or a client asks you to update where you send payments. Always confirm by calling a number you already have on file, never one listed in the email.
If someone does click
It happens, even to careful people. What matters is how quickly you respond. Tell your IT provider right away, disconnect the computer from the network if anything was downloaded, and change the password for any account that was entered on a suspicious page. Make sure your team knows they won't get in trouble for reporting it. A quick report is far better than a quiet mistake.
Help with email security
We set up email authentication (SPF, DKIM and DMARC), spam filtering and multi-factor authentication for our clients, and we can run safe phishing tests so your team gets some practice. Get in touch if you'd like to talk it through, or ask about our free IT and security checkup.