Scams & fraud
How to spot a phishing email (and what to do with one)
Phishing emails have moved on from bad spelling and Nigerian princes. Today’s versions copy real invoices, shared documents and password alerts, sometimes from a real account that’s been hacked. The good news is that almost all of them still need you to do one thing: click, sign in or pay. That’s where you catch them.
The short version
Before you click
- Ask what the email wants you to do.
- Check the real sender address, not just the name.
- Hover over or long-press links to see where they go.
- When in doubt, open the service directly instead of using the email.
What phishing is trying to get
Every phishing email wants one of four things:
- Your password, usually by sending you to a fake sign-in page for Microsoft 365, Google, your bank or a delivery service.
- Your money, often through a fake invoice or a change to someone’s bank details.
- Your device, by getting you to open an attachment or install something.
- Your information, such as ID documents, tax file number or customer data.
If you know which of those an email is after, it’s much easier to slow down at the right moment.
The checks that actually work
Look at the sender’s real address
The display name says whatever the scammer wants. Tap or hover over it to see the actual address. “Microsoft Support” sending from a Gmail account, or “Your Bank” from an address ending in something odd, is a giveaway. Be careful with near-misses like a letter swapped or an extra word in the domain.
Check where the link really goes
On a computer, hover your mouse over the link without clicking and look at the address that appears. On a phone, press and hold the link to preview it. If the address doesn’t belong to the company the email claims to be from, don’t open it.
Ask whether you were expecting it
A shared document from someone you haven’t worked with, a voicemail sent by email, an invoice for something you didn’t order, or a password expiry notice you’ve never had before are all classic lures.
Notice pressure
“Your mailbox will be deleted today.” “Payment overdue: final notice.” “Unusual sign-in, verify now.” Pressure is designed to make you skip the checks above.
Be wary of sign-in pages reached from email
If clicking a link takes you to a page asking for your password, stop. Close it, open a fresh browser tab and go to the service yourself. If you were already signed in a minute ago, a sudden request to sign in again is a red flag.
A real sender doesn’t mean a safe email
If a supplier’s or colleague’s mailbox has been hacked, phishing can arrive from their genuine address, often as a reply in an existing conversation. If an email from someone you know asks you to sign in somewhere, pay something new or change bank details, check with them by phone first.
Common lures right now
| The email says | What’s usually going on |
|---|---|
| Someone shared a document or sent you a secure file | A fake Microsoft, Google, Dropbox or e-signature page asks for your password. |
| Your mailbox is full or your password is expiring | A fake admin page collects your work login. |
| An invoice is attached, or payment details have changed | Either malware in the attachment, or a request to pay a scammer’s account. |
| You missed a delivery, a toll payment or a fine | A fake payment page collects your card details. |
| There’s a refund, rebate or prize waiting | Bait to collect bank details or personal information. |
| A QR code to scan for a document or to set up security | Moves the link onto your phone, where it’s harder to inspect. |
What to do with a phishing email
- Don’t click, reply or download anything.
- Report it. At work, use the Report or Report phishing button in Outlook or Gmail if you have one, or forward it to whoever looks after IT. At home, use your email provider’s report-phishing option.
- Delete it once reported.
- If it pretends to be a particular company, many have a scam reporting address on their website. You can also report it to Scamwatch.
If you clicked or entered details
Don’t wait to see whether anything happens. Fast action makes a big difference.
You entered a password
Go to the real service and change the password straight away. Sign out of all other sessions if the option exists, and turn on two-step verification. If you use that password anywhere else, change it there too.
You entered it at work
Tell your IT contact or manager now. They can reset your password, end any sessions the attacker started and check whether rules were added to your mailbox. Reporting quickly is the most helpful thing you can do, and no reasonable workplace will blame you for it.
You opened an attachment
Disconnect the computer from Wi-Fi or the network cable and contact IT. At home, run a full scan with your security software and change important passwords from a different device.
You paid an invoice or sent money
Call your bank immediately and ask them to try to recall the payment. The first hours matter most. See our guide to invoice and payment redirection scams.
Reducing phishing at work
- Turn on two-step verification for every staff account, so a stolen password alone isn’t enough.
- Make sure your email domain has SPF, DKIM and DMARC set up, which makes it harder for scammers to send email pretending to be you.
- Add a report-phishing button and thank people who use it.
- Run short, regular reminders using real examples rather than a yearly training video.
Practise on fake examples
Spot a phishing email is a free NovaSoft Labs course with six fictional scenarios and an explanation for every answer. Pass it to print a completion certificate.
Common questions
Is it dangerous just to open a phishing email?
Opening and reading an email is very rarely a problem on an up-to-date device. The risk comes from clicking links, opening attachments or replying.
The email has the company’s real logo. Does that mean anything?
No. Logos are easy to copy. Check the sender address and where the links go.
Why didn’t my spam filter catch it?
Filters catch most phishing, but scammers test their emails against them. A few always get through, which is why your own checks matter.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.