How to spot a phishing email in 30 seconds

Phishing emails no longer look like obvious scams. Many are well written, use a real-looking logo and arrive at a busy moment. Staff do not need to become security experts to catch them. They need a short habit they can run in the time it takes to read the subject line and first paragraph.

Here is a 30-second checklist we teach in small offices, plus what to do when something feels off.

Second 1 to 10: check the sender

Look past the display name. The name can say anything. The actual address is what matters.

1. Expand or hover over the sender name to see the full email address.
2. Check the domain after the @ sign. Watch for extra words, swapped letters, or a different ending, such as a company name followed by "-billing" or a ".co" instead of ".com".
3. Notice free email accounts claiming to be a bank, a government office or a large vendor.
4. Look for the external sender tag if your email system adds one. A message "from your CEO" with an external tag is a red flag.

A real address does not prove a message is safe. Accounts get compromised, so a phishing email can come from a genuine customer or vendor mailbox. That is why the next steps matter.

Second 10 to 20: check the request

Almost every phishing email asks you to do one of a handful of things:

• Sign in to view a document, voicemail, invoice or shared file.
• Pay an invoice, change bank details or buy gift cards.
• Open an attachment you were not expecting.
• Approve a sign-in, reset a password or "verify" your account.
• Reply with personal or company information.

Ask yourself whether you expected this request from this person today. An unexpected request that involves money, passwords or files deserves a second look every time.

Second 20 to 30: check links, attachments and pressure

1. Hover over links without clicking. On a phone, press and hold. If the web address does not match the company it claims to be, stop.
2. Be wary of sign-in pages reached from email. If you need to check an account, type the address yourself or use a saved bookmark.
3. Treat unexpected attachments with caution, especially compressed files, HTML files, and Office documents that ask you to enable content or macros.
4. Notice pressure and secrecy. "Urgent," "final notice," "account suspended," or "keep this between us" are classic tactics to rush you.
5. Watch for QR codes in emails asking you to scan and sign in. They move the link to your phone, where it is harder to inspect.

Patterns we see often

• A "shared document" notice that leads to a fake email sign-in page.
• A vendor saying its bank account has changed, with new payment instructions attached.
• A message from a manager asking for a quick favor while they are "in a meeting."
• A delivery or toll notice asking for a small payment.
• A reply in an old, real email thread that suddenly includes a link or new invoice.

Some attackers now steal sign-in sessions or send repeated MFA prompts, so a convincing fake page can still be dangerous even when MFA is on. Our post on MFA fatigue and token theft in Microsoft 365 explains how that works.

What to do with a suspicious email

1. Do not click, reply or forward it to coworkers.
2. Report it using your email system's report button, or send it to whoever handles IT.
3. Verify through another channel. Call the person using a number you already have, not one in the email.
4. If you already clicked or entered a password, tell IT right away. Changing the password and signing out other sessions quickly limits the damage.

Make reporting easy and never punish people for it. A staff member who reports a mistake in five minutes is far more valuable than one who hides it for a week.

Make the habit stick

A one-time talk fades. Short, regular reminders work better: a few minutes in staff meetings, simulated phishing tests with friendly follow-up, and a written rule that any change to payment details is confirmed by phone. Pair the training with good email filtering, so fewer bad messages reach people in the first place.

Getting help

We run cyber awareness training and phishing simulations for small teams, and set up email security filtering that catches more of these messages before staff see them. We work with businesses throughout Los Angeles County, the Inland Empire and Ventura County.