How to Spot a Phishing Email (and Train Your Team to)

Short answer: Phishing — tricking someone into clicking a bad link or handing over credentials — causes most business breaches, because it attacks people, not software. The tell-tale signs are false urgency, a sender address that doesn't quite match, generic greetings, unexpected links or attachments, and requests for passwords or payment. The golden rule: verify any money or password request through a second channel before acting. Training your team to pause and check is the single highest-return security step most businesses can take — and it's nearly free.

You can have the best firewall and antivirus money can buy, and still get breached because someone clicked a link in an email. That's phishing — and it's behind the large majority of business attacks precisely because it skips the technology and goes straight for the person. The good news: once you know what to look for, most phishing is easy to spot. Here's how. (This is the human side of the security basics.)

Why phishing works (and why it's the biggest threat)

Phishing is an attacker pretending to be someone you trust — your bank, a supplier, a colleague, your boss — to trick you into clicking a malicious link, opening a bad attachment, or handing over a password or payment.

It works because it doesn't attack your software, where your defences are. It attacks your people, using urgency and authority to make them act before they think. That's why even well-protected businesses fall for it — and why awareness matters as much as any tool.

The tell-tale signs

Most phishing emails give themselves away if you slow down and look:

• False urgency or threat — "your account will be closed", "act within 24 hours". Pressure is the oldest trick; it stops you thinking.
• A sender address that's slightly off — support@paypa1.com instead of paypal.com, or a display name that doesn't match the real address.
• Generic greeting — "Dear Customer" instead of your name, from a company that knows your name.
• Unexpected links or attachments — especially invoices, "documents to review", or login pages.
• Requests for passwords, payment, or sensitive details — legitimate organisations rarely ask for these by email.
• Small wrongness — odd spelling, slightly off formatting, a logo that's not quite right.

One sign on its own might be nothing. Several together is a strong warning.

The common scams aimed at businesses

A few patterns show up again and again:

• The fake invoice — an attachment or link claiming you owe money, hoping you'll pay or open it.
• CEO / boss fraud — an email "from the boss" urgently asking for a payment or gift cards. (Verify with a real call — always.)
• Account-locked — a fake warning that an account is suspended, linking to a fake login page to steal your password.
• Supplier change — a "supplier" emailing new bank details for future payments. Always verify directly.

The golden rule

If you remember one thing, make it this: verify any money or password request through a second channel before acting. Got an urgent payment email "from the boss"? Phone them. New bank details from a supplier? Call a known number. A thirty-second check beats a costly mistake every time.

What to do if someone clicks

It happens — and speed limits the damage. If a link gets clicked or details entered:

1. Disconnect the device from the network.
2. Change any passwords that might be exposed.
3. Check MFA is on, so a stolen password alone can't be used.
4. Tell your IT support immediately.

This is exactly why MFA and backups matter — they contain the blast radius when a click slips through.

Train your team — it's the best return there is

Technology (email filtering, MFA) blocks a lot of phishing, but aware people are the deciding layer. A short, regular conversation with your team — here's what to watch for, here's the verify-first rule, here's who to tell — prevents more breaches than almost any tool, and costs almost nothing. Make it normal to pause and check, and to ask "is this real?" without embarrassment.

The bottom line

Phishing causes most business breaches because it targets people, not software — but it's beatable. Learn the signs (urgency, mismatched senders, unexpected links, requests for passwords or money), know the common scams, and live by the golden rule: verify anything sensitive through a second channel. Pair that awareness with email filtering and MFA, and you've closed the door most attackers walk through — which is exactly the layered protection we help businesses put in place.