Recognizing Phishing Emails

Phishing remains the #1 way attackers breach businesses. These emails trick employees into revealing passwords, downloading malware, or authorizing fraudulent payments. Learning to recognize phishing attempts is your first line of defense.

Why Phishing Works

Phishing exploits human psychology, not technical vulnerabilities:

• Authority: Emails impersonate bosses, executives, or trusted organizations
• Urgency: "Your account will be closed" or "Immediate action required"
• Fear: Threats of legal action, suspended accounts, or security breaches
• Curiosity: "You've received a secure message" or unexpected package delivery
• Greed: Prizes, refunds, or financial opportunities

Modern phishing emails are sophisticated—gone are the days of obvious Nigerian prince scams. Today's attacks look professional, use correct logos, and even spoof real email addresses.

10 Red Flags of Phishing Emails

1. Generic Greetings

Warning signs: "Dear Customer," "Dear User," "To Whom It May Concern"

Why it's suspicious: Legitimate companies use your name. They have it in their database.

Example: "Dear Valued Customer" vs. "Dear John Smith"

2. Suspicious Sender Address

Warning signs: Misspelled domains, unexpected senders, generic email addresses

How to check: Click the sender name to reveal the full email address

Examples of suspicious addresses:

• [email protected] (not paypal.com)
• [email protected] (not @microsoft.com)
• [email protected] (random domain)

3. Urgent or Threatening Language

Warning signs: "Act now!" "Immediate action required!" "Your account will be suspended!"

Why it works: Urgency bypasses critical thinking

Remember: Legitimate companies don't threaten to close accounts via unsolicited email

4. Requests for Sensitive Information

Never provide via email:

• Passwords or PINs
• Social Security numbers
• Credit card numbers
• Account credentials
• Security question answers

Golden rule: No legitimate company asks for passwords via email. Ever.

5. Suspicious Links

How to check: Hover over links (don't click!) to see the actual destination

Warning signs:

• Links don't match the claimed destination
• Shortened URLs (bit.ly, tinyurl) from unknown senders
• Misspelled domains (microsfot.com, paypai.com)
• Suspicious subdomains (microsoft.securelogin-verify.com)

Example: Email claims to be from Amazon, but link goes to amaz0n-prime.net

6. Unexpected Attachments

Dangerous file types:

• .exe (executable programs)
• .zip (compressed files that hide malware)
• .js or .vbs (script files)
• Office documents with macros enabled
• PDFs with suspicious links

Rule: Never open attachments from unexpected senders, even if they appear to be from known contacts (email accounts get compromised).

7. Poor Grammar and Spelling

Warning signs:

• Obvious typos and grammatical errors
• Awkward phrasing or unusual word choices
• Inconsistent formatting

Note: Modern AI-powered phishing is well-written, so don't rely on this alone. However, errors are still common in mass phishing campaigns.

8. Too Good to Be True

Common lures:

• "You've won a prize!" (that you didn't enter)
• "Unclaimed refund of $1,500"
• "Your package couldn't be delivered" (when you didn't order anything)
• "Congratulations! You've been selected..."

Remember: If it sounds too good to be true, it probably is.

9. Mismatched or Missing Company Information

Check for:

• Missing company address or contact information
• Wrong logo or outdated branding
• Generic signatures without specific contact info
• Legal disclaimers that don't match the claimed sender

10. You Don't Have an Account

Red flag: Email claims your "account" has a problem, but you don't use that service

Examples:

• PayPal security alert (you don't have PayPal)
• Netflix subscription issue (you don't subscribe)
• Amazon delivery problem (you didn't order anything)

This seems obvious, but mass phishing campaigns bet that some percentage of recipients DO use the service.

Common Phishing Scenarios

CEO Fraud / Business Email Compromise

Email appears to be from your CEO or executive requesting urgent wire transfer or purchase of gift cards. The "From" address is spoofed or similar to the real address.

Defense: Verify any unusual financial requests via phone or in person. Establish policies requiring dual approval for wire transfers.

Invoice Scams

Fake invoices from vendors you work with, but with updated payment instructions redirecting money to attacker accounts.

Defense: Verify any changes to vendor payment information through a known phone number (not one in the email).

Password Reset Phishing

"Your password will expire" or "Unusual activity detected—verify your account" with links to fake login pages.

Defense: Never click links in unsolicited emails. Go directly to the website by typing the URL yourself.

Delivery Notification Scams

Fake FedEx, UPS, or USPS delivery notifications with tracking links that download malware.

Defense: If you're expecting a package, check the tracking number on the carrier's official website directly.

What to Do If You Click

If you clicked a suspicious link:

1. Don't enter credentials if you're taken to a login page
2. Close the browser immediately
3. Report to IT right away—don't wait out of embarrassment
4. Change passwords if you entered credentials anywhere
5. Run antivirus scan on your computer
6. Monitor accounts for suspicious activity

If you opened an attachment:

1. Disconnect from network (unplug ethernet or disable WiFi)
2. Report to IT immediately—this is an emergency
3. Don't turn off computer (makes forensics harder)
4. Wait for IT guidance before reconnecting

Creating a Security-Aware Culture

Make it easy to report suspicious emails:

• Provide a dedicated email address ([email protected])
• Install "Report Phishing" buttons in email clients
• Never punish employees for reporting false alarms
• Praise employees who catch and report phishing attempts

Conduct regular training:

• Quarterly security awareness sessions
• Share examples of recent phishing attempts (sanitized)
• Simulated phishing tests to gauge awareness
• Short reminder emails with tips

Use technical controls:

• Email filtering to block obvious phishing
• Warning banners on external emails
• Link protection that scans URLs before users click
• Attachment sandboxing to analyze suspicious files

When in Doubt

Follow these steps:

1. Stop and think before clicking or replying
2. Verify independently by contacting the supposed sender through known channels
3. Report suspicious emails to IT even if you're not sure
4. Trust your instincts—if something feels off, it probably is

The Bottom Line

Phishing attacks succeed because they exploit trust and urgency. By learning to recognize the warning signs and developing healthy skepticism toward unexpected emails, you become a human firewall protecting your organization.

Remember: It's better to verify a legitimate email than to click on a malicious one. When in doubt, ask IT. That's what we're here for.