How to Spot a Phishing Email: 7 Signs Every Small Business Team Should Know

Phishing emails are designed to look like something you would normally get: an invoice, a shared file, a password warning or a message from your boss. Security software catches most of them, but not all. The last line of defense is the person reading the email.

Here are the seven signs I teach every team I work with.

1. The sender’s address doesn’t match the name

The name says “Microsoft 365” or the name of your vendor, but the actual email address is something like support@m365-security-alert.co. On a phone, tap the sender’s name to see the real address.

2. It’s urgent, or it’s a threat

“Your account will be closed in 24 hours.” “Payment overdue, final notice.” Attackers want you to act before you think. Real companies rarely give you a countdown.

3. The link goes somewhere unexpected

Hover over a link on a computer, or press and hold on a phone, to see where it really goes. If an email from your bank links to a site that isn’t your bank’s address, don’t click.

4. It asks you to sign in

Shared file links that ask for your Microsoft or Google password are one of the most common tricks I see. If you weren’t expecting a file, go to OneDrive or Google Drive directly instead of using the link.

5. Your boss or a vendor asks for money in a new way

“Can you buy gift cards for a client?” “We changed banks, please send this payment to our new account.” Always confirm a payment change with a phone call to a number you already have, not the one in the email.

6. The attachment is unusual

Invoices as zip files, Word documents that ask you to “enable content,” or files ending in .html or .iso are red flags. When in doubt, ask before you open.

7. Something just feels off

Odd greetings, a strange time of day, a writing style that doesn’t sound like the person. Trust that feeling. It is usually right.

What to do if you already clicked

Don’t panic, and don’t hide it. The faster you act, the less damage an attacker can do.

1. Disconnect from WiFi or unplug the network cable if you opened an attachment.
2. Change your password from a different device if you entered it on a website.
3. Call your IT person right away so they can check the account and lock things down.

My clients have 24/7 threat detection, AI email security and simulated phishing tests that train their teams to spot these emails. If you want to know how your team would do, I can help.