How to spot a phishing email

Before you click anything

1. Is it urgent? Pressure to act today, or else, is the oldest trick there is.
2. Did you expect it? An invoice, shared file or voicemail you were not waiting for deserves a second look.
3. Who really sent it? Look at the address, not just the display name. Watch for small changes like an extra letter or a different ending.
4. Where does the link go? Hover over it (or press and hold on a phone) to see the real address before you open it.
5. Does it ask you to sign in? If a link leads to a sign-in page, close it and go to the site the way you normally would.
6. Is it about money or passwords? Requests to change bank details, buy gift cards or share a code should always be confirmed another way.
7. Does something feel off? An odd greeting, unusual tone or a request your colleague would never make is reason enough to check.

If you are not sure

Ask. A quick call to the sender, using a number you already have, settles most doubts. Report the message to IT so others can be warned, even if you did not click.