Phishing emails aren’t what they used to be. The badly spelled “Nigerian prince” messages of the early 2000s have mostly been replaced by emails that copy real company branding, use your actual name and turn up right when you’re waiting on a parcel or an invoice. A lot of them are now written with AI tools too, so “look for bad grammar” doesn’t really work as a rule any more.
Thankfully, most phishing emails still lean on the same handful of tricks. Once you know them, they get a lot easier to spot. Here are nine things worth checking before you click on anything.
1. The sender’s address doesn’t match the company
The display name might say “PayPal” or “Royal Mail”, but the actual address is where the truth is. Tap or hover over the sender name to see the full email address, and look out for:
- Free email providers, like a Gmail or Outlook address claiming to be your bank
- Lookalike domains, such as paypa1.com, amaz0n-support.co or royalmail-redelivery.info
- Real brand names tucked inside a different domain, like microsoft.account-verify.net
The bit that matters is whatever comes directly before the final .com or .co.uk. Anything to the left of that can be made up by whoever registered the domain.
2. It’s trying to rush you
“Your account will be suspended in 24 hours.” “Unusual sign-in detected – act now.” “Final notice before legal action.” Scammers want you to react before you’ve had time to think. Real companies very rarely threaten instant consequences over email, and none of them will mind if you take ten minutes to check.
If an email makes your heart rate go up, that’s usually the sign to slow down.
3. The greeting is generic (or a bit too specific)
“Dear Customer” or “Dear Valued User” from a company that definately knows your name should make you suspicious. The opposite can catch people out as well, though. Targeted phishing, often called “spear phishing”, uses details pulled from social media or old data breaches (your job title, your manager’s name, something you bought recently) to make a message feel genuine. An email knowing a few things about you doesn’t prove it’s real.
4. Links don’t go where they say they do
The text of a link and where it actually goes can be completely different things. On a computer, hover over the link without clicking and check the address that shows up at the bottom of the window. On a phone, press and hold the link to preview it.
Be wary of shortened links (bit.ly and similar), long strings of random characters and anything that doesn’t match the company’s real website. If you’re not sure, don’t use the link at all. Open your browser and type the company’s address in yourself.
5. It asks for things a real company wouldn’t
Banks, HMRC, delivery firms and software companies don’t email you asking for your password, your full card number, your PIN or a one-time security code. If an email wants you to “confirm” or “verify” any of those, it’s almost certainly a scam, no matter how official it looks.
One-time codes are worth calling out on their own. If someone asks you to read back or forward a code that’s just been sent to your phone, there’s a good chance they’re trying to log in to your account at that exact moment.
6. There’s an attachment you weren’t expecting
Attachments are still one of the most common ways malware ends up on people’s computers. Be careful with anything you didn’t ask for, especially:
- Invoices or “remittance advice” from companies you’ve never dealt with
- Zip files, or files ending in .exe, .html, .iso or .js
- Office documents that ask you to “enable content” or “enable macros” before you can read them
If a colleague or supplier sends you something out of the blue, check with them through a seperate channel first, like a quick phone call or a message on Teams or Slack.
7. It’s too good to be true
A tax refund you never applied for. A prize from a competition you didn’t enter. A crypto investment with “guaranteed” returns that some celebrity is supposedly backing. Scammers know excitement switches off our caution just as well as fear does. If you weren’t expecting money, you’re probably not owed any.
8. Someone’s bank details have “changed”
This one mostly hits businesses. An email comes in, apparently from a supplier, a contractor or even your solicitor, saying their bank details have changed and asking you to pay the next invoice into a new account. Sometimes it really does come from the supplier’s own email address, because their account has been hacked.
Always confirm a change of bank details by ringing a number you already have on file, never one from the email itself. That one habit stops some of the most expensive fraud small businesses run into.
9. Something just feels off
Odd formatting, a slightly blurry logo, a tone that doesn’t sound like the person who’s meant to have sent it, or an email at 3am from a colleague who never works late. You don’t need to be able to put your finger on exactly what’s wrong. If your gut says something isn’t right, that’s reason enough to check before you do anything.
What to do if you spot one
Don’t reply, don’t click any links and don’t open any attachments. Instead:
- Report it. In the UK you can forward suspicious emails to [email protected]. It’s run by the National Cyber Security Centre, who can take down scam websites and email addresses, and their page on reporting a scam email explains how it all works. Dodgy text messages can be forwarded to 7726.
- Tell your IT team if it came to a work address, so they can warn everyone else and block the sender.
- Delete it once you’ve reported it.
What if you’ve already clicked?
It happens to careful, techy people too, so try not to panic. Just act quickly:
- If you typed in a password, change it straight away, along with any other account that uses the same one.
- Turn on two-factor authentication wherever it’s available.
- If you gave out bank or card details, ring your bank immediately using the number on the back of your card.
- If you’ve lost money, report it. In England, Wales and Northern Ireland that’s through Report Fraud, and in Scotland it’s Police Scotland on 101.
- If you opened an attachment, run a security scan, and let IT know if it was a work device.
It’s also worth checking whether your email address has turned up in a known data breach with a free tool like Have I Been Pwned. Addresses that have been leaked in breaches tend to recieve a lot more targeted phishing than ones that haven’t.
Wrapping up
No single one of these proves an email is a scam, and a well made phishing email might only tick one or two boxes. The habit that matters most is pretty simple. Whenever an email asks you to click, pay, log in or hand something over, stop and check it another way. Go straight to the website, call a number you already trust or message the person separately. Scammers are relying on you acting fast, so taking a minute to check is usually all it takes to beat them.
WordPress Theme: Lavoie
