How to Spot a Phishing Email: Red Flags, Examples and What to Do

How to spot a phishing email: the short answer

To spot a phishing email, look for pressure combined with a request. Most phishing emails pair urgency, fear or flattery with a request. They want you to click, log in, open a file, pay or share information. Check the real sender address and hover over links before clicking. Confirm any unusual request through a channel you already trust, such as a known phone number.

Spelling mistakes used to be the giveaway. They are a weak sign now, because attackers use AI writing tools and copy real company emails. Focus on what the email asks you to do, not how well it is written.

What is phishing? A simple definition

Phishing is a type of social engineering, which means tricking people rather than hacking computers. The attacker sends a message pretending to be a trusted person or company. The aim is to get you to reveal passwords, send money or install malware (harmful software). Email is the most common channel. But the same scams arrive by text (smishing), phone (vishing), QR code and chat apps.

Mass phishing goes to thousands of people at once. Spear phishing targets one person or team with researched details. Our guide to social engineering covers the related attacks.

Red flags checklist

One red flag is a reason to slow down. Two or more is a reason to verify before doing anything.

• Sender mismatch: the display name says your CEO or a supplier, but the address is a personal account or a lookalike domain. Watch for rn instead of m, an extra letter, or a different ending such as .co instead of .com.
• Reply-to differs from sender: replies would go to an address you have never seen.
• Urgency or threats: "account suspended", "final notice", "within 24 hours".
• Money requests: gift cards, wire transfers or changed bank details.
• Links that do not match: hovering shows a different domain or a link shortener. Or it shows a trick such as microsoft.com.account-verify.example. Here the site you would actually visit is account-verify.example, not microsoft.com.
• A login page after an email link: real services rarely need you to sign in from an email. Go to the site directly instead.
• Unexpected attachments: especially HTML files, ZIP or ISO archives, password-protected files and Office documents that ask you to enable macros (small programs inside the file).
• QR codes asking you to scan to re-authenticate or view a document.
• Requests for secrecy or to skip the normal process.
• An external email banner on a message that claims to come from a colleague.
• Odd tone or timing: a formal message from someone who is always casual, or a request sent late on a Friday.
• Too good to be true: refunds, prizes or a bonus you were not expecting.

Phishing email examples: five common scams

1. The fake invoice. A known supplier emails to say their bank details have changed and the attached invoice should be paid to the new account. Sometimes it comes from the supplier's real mailbox, which has been hacked. The tell: a change of bank details by email. What to do: call the supplier on a number from your records and confirm before paying.

2. The CEO gift card request. "Are you at your desk? I need a quick favor, keep this between us." Then a request to buy gift cards for clients and send the codes. The tell: secrecy, urgency and gift cards. No real executive pays clients this way.

3. The MFA reset. MFA is the second login step, such as a code on your phone. An email styled like Microsoft or Google says your MFA will expire today and you must re-register, often with a QR code. The link leads to a page that captures your password and MFA code. The tell: MFA does not expire by email notice. Contact IT directly.

4. The shared document. "Sarah shared 'Q4 Salary Review' with you." The link opens a convincing sign-in page. The tell: you were not expecting the file, and opening it asks for your password again. Open the file from inside OneDrive or Google Drive instead of the email link.

5. The delivery notice. A courier says a parcel is held until you pay a small fee or confirm your address. The tell: a payment request for a delivery you cannot match to an order. Check tracking on the courier's own site.

These phishing scams work because each one copies a normal business task. That is why training should use examples like these rather than obvious fakes.

What to do if you clicked a phishing link

Speed matters more than embarrassment. Security teams would much rather hear about a click in five minutes than find out in five weeks.

1. Report it now to IT or your security provider. Say exactly what you did: clicked, entered a password, approved an MFA prompt, opened a file or sent money.
2. If you opened a file, disconnect the device from the network but do not wipe it. Investigators may need it.
3. If you entered a password, change it from a different device, sign out all sessions, and check for new MFA methods and inbox rules.
4. If you sent money, call your bank immediately and ask for a recall. In the US, also report it to the FBI at ic3.gov.
5. Watch for follow-ups. Attackers often try again, or use your account to phish your colleagues and customers.

If a mailbox has been taken over or money has moved, treat it as an incident and get incident response help.

How to make phishing harder for the whole team

Training helps, but someone will eventually click. Layer these controls so a single click does less damage:

• SPF, DKIM and DMARC settings on your domain, which block email that fakes your own address
• External sender banners and a one-click report button
• Phishing-resistant MFA such as passkeys, which defeats fake login pages (see adversary-in-the-middle attacks)
• A written rule that payment changes are always verified by phone
• Short, regular training with realistic simulations

For the full list, see our 20 cybersecurity tips for businesses.

How NextGarrison helps

We run security awareness training and practice phishing emails built on the scams your industry actually sees. Our 24/7 SOC, a team that watches for attacks around the clock, looks for the account takeovers that follow a successful phish. Talk to us about awareness training.