Recognizing Phishing Emails: A Simple Guide for Employees

Phishing is an email or message that pretends to come from a trusted sender to get you to do something: enter your password on a fake page, open an infected attachment or send money to a different account. These emails are no longer always full of spelling mistakes and suspicious-looking; sometimes they look exactly like an email from your bank, a courier, a supplier or even your own manager. That is why employee awareness is one of the most important layers of defense.

Five Warning Signs

1. Urgency and pressure: “Your account will be closed in one hour”, “Pay right now”. The attacker wants to leave you no time to think.
2. A sender that is not right: The display name may say “Finance Department”, but the actual email address is something else. Watch for look-alike domains too, such as one swapped letter or the letter l replaced with the number 1.
3. A link that goes somewhere else: Before clicking, hover your mouse over the link and check the real address. The link text may be completely different from its destination.
4. An unexpected attachment: An invoice, receipt or “scanned documents” you were not expecting, especially compressed files, HTML files or documents that ask you to “enable content”.
5. An unusual request: A request for a password, verification code, a change of bank account number or an urgent gift card purchase, even if it appears to come from the CEO.

Bank Account Change Fraud

This is one of the costliest types of phishing: an email that appears to come from a real supplier says their bank account has changed and asks you to pay the invoice into the new account. Sometimes this email is even sent from the supplier’s real mailbox, which has been hacked, and shows no visible warning signs.

Golden rule: confirm every request to change bank details or make an urgent payment with a phone call, using a number you already have, not one given in that email.

Fake Login Pages

The most common goal of phishing is stealing email and work account passwords. The link takes you to a page that looks exactly like your webmail or company portal. Before entering your password, always check the address in the browser bar. The padlock icon next to the address only means the connection is encrypted, not that the site is genuine. The best practice is to type the address yourself or use a saved bookmark to log in.

What to Do If You Clicked

Anyone can make a mistake; what matters is how quickly you report it:

• Tell the IT department immediately; the sooner, the less damage.
• If you entered a password, change it from a clean device.
• If you opened a file and the computer is behaving strangely, unplug the network cable or turn off Wi-Fi and wait for instructions.
• Do not forward the email to coworkers; report it following company procedure.

Managers also need to create an environment where nobody is afraid to report a mistake. An employee who stays silent for fear of blame keeps the attack hidden.

Tips for Managers and the IT Department

• Short, regular training with real examples that have reached your own company is more effective than one long annual session.
• Define a simple, clear way to report suspicious emails.
• An “External email” tag at the top of messages from outside the company helps staff spot attackers impersonating coworkers.
• Make spoofing your company’s own domain harder by configuring SPF, DKIM and DMARC correctly.

Checklist

• I check the real address of a link before clicking.
• I check the sender’s address, not just their name.
• I never send passwords or verification codes to anyone.
• I confirm bank account changes by phone.
• I report suspicious emails immediately.

ITPlus724 engineers can run a short training session for your employees and review the security settings of your business email.