How to Recognize a Phishing Email Before It's Too Late

The warning signs that still work

No single signal is proof, but a combination should trigger caution. Train your team to slow down when they see two or more of these.

• Sender address slightly wrong (m1crosoft.com, support@microsott.com)
• Display name matches a real person, but the underlying email address doesn't
• Urgency and pressure: 'you have 24 hours', 'account will be suspended'
• A link to review, approve, or sign in: hover to see the real URL before clicking
• Unusual request outside normal process: CEO asking for gift cards, vendor changing bank details
• Attachment you weren't expecting, especially .html, .htm, .zip, .iso, or Office files with macros
• Generic greeting when the sender should know your name
• Grammar, spelling, or formatting inconsistent with the real sender

Common phishing tactics we see against Sudbury businesses

What to do when you spot a suspicious email

• Don't click the link, don't open the attachment, don't reply
• Report it to IT or use the 'Report Phishing' button if configured in Outlook
• If you already clicked and entered a password, reset the password immediately and tell IT
• If you already sent money, contact your bank first, then IT, then your cyber insurer

Prevention beats detection

Individual vigilance matters, but layered controls stop far more attacks than training alone. Email filtering with impersonation detection, MFA on every account, and EDR on every endpoint together stop the vast majority of phishing consequences even when a click happens.

Frequently asked questions