How to spot a phishing email in 30 seconds
Most attacks on companies start with an email. You don't need to know about computers to catch them: just look at five things before you click.
1. Who's really sending it
The name shown can be anything. Look at the address after the @: “support@micros0ft-pt.com” isn't Microsoft, and “invoices@supplier-pt.net” may not be your supplier. On your phone, tap the name to see the full address.
2. The urgency and the request
- Urgency: “today”, “urgent”, “your account will be blocked”, “final notice”.
- It asks for your password, a code you received by text, a payment or card details.
- It asks for secrecy: “don't talk to anyone about this”, “reply by email only”.
3. Where the link goes
On a computer, hover over the link without clicking and read the address that appears in the corner of the screen. If it isn't the site you expected, don't click. No bank, nor Microsoft, nor the tax office asks for your password by email.
4. What's attached
Be wary of attachments you weren't expecting, especially .zip, .html or .iso files, or documents that ask you to “enable content” or “enable editing” to view them. A real invoice doesn't need that.
5. Whether the request makes sense
Were you expecting this email? Does this person usually write to you like this? If the answer is no, confirm another way: call the number you already had, or talk to the person. Never use the contact details in the email itself.
If you've already clicked
- 01 Change that account's password from another device, and on every account where you used the same one.
- 02 Tell whoever handles IT at the company right away, even if it seems nothing happened.
- 03 Don't delete the email: it helps work out what happened and warn your colleagues.