A convincing logo and polished writing do not make an email trustworthy. Learn to check the request, verify the sender independently and respond quickly if you have already interacted with a suspicious message.
Knowing how to spot phishing emails is useful whether you manage a small business inbox, study online or simply receive delivery updates. A fraudulent message may copy a familiar brand, arrive in an existing conversation or claim that your account will close unless you act immediately.
The safest habit is to separate the email’s claim from your next action. If it says a payment failed, check your account through a trusted app or saved address. If it asks for a bank-detail change, verify that change through an established contact. You do not have to prove an email is malicious before choosing a safer route.
1. Read the actual sender address
The display name is easy to imitate. Expand the sender details and compare the address with a previously verified source. Look for unexpected domains, extra words or small spelling changes. A familiar name alone is not enough to establish who sent the message.
Even a genuine account can be compromised, so a matching address is a useful check rather than a guarantee. If the request is unusual for that person or organisation, continue verifying it independently.
2. Question pressure and secrecy
Messages that demand an immediate payment, threaten a sudden account closure or insist that nobody else should be consulted deserve particular care. The pressure is intended to shorten the time available for checking.
Pause before responding. A real deadline can be verified through the organisation’s normal channels. In a workplace, a request to bypass the usual payment approval process should trigger that process rather than replace it.
3. Open the service independently
If an email claims that your bank, shopping account or subscription needs attention, open the official app or use a trusted bookmark. Do not use the message’s button as your only route to the alleged problem.
Microsoft’s phishing guidance describes mismatched destinations, unusual requests and unexpected attachments as warning signs. On devices that support it, inspecting a link’s destination can help, but do not click it just to investigate. A padlock or HTTPS connection does not prove a website belongs to the claimed organisation.
4. Treat unexpected attachments cautiously
An invoice, document or archive can look routine while carrying a different purpose. Ask whether you expected the file and whether the sender normally uses that format. Do not enable macros, install unfamiliar software or weaken security settings because an attachment tells you to.
Verify through a known phone number or separate trusted conversation. Replying to the same suspicious message does not independently confirm its authenticity. Follow your organisation’s reporting process if you use a work account.
5. Keep passwords and verification codes private
Be suspicious of messages asking you to send a password, banking PIN or one-time code. Do not approve an unexpected sign-in prompt simply to make it disappear. Check the account’s security area through a trusted route instead.
Use strong, unique credentials and suitable multi-factor authentication. These measures reduce risk but do not make every message safe. ReviewStreet’s password manager guide for small teams explains useful considerations when organising shared workplace security habits.
6. Verify changed payment instructions separately
A message announcing new supplier bank details can have consequences even if it contains no link or attachment. Compare it with the established payment process and confirm through a previously verified contact number, not one supplied in the new email.
For small teams, define who can approve bank-detail changes and record the verification. A quick independent check is easier than trying to recover a transfer made to the wrong account. Read ReviewStreet’s mobile payment cybersecurity coverage for related awareness topics.
7. Do not rely on spelling mistakes
Poor grammar can be a clue, but well-written emails can still be fraudulent. Attackers can copy genuine templates and tailor messages using publicly available information. Your job title, recent purchase interest or a colleague’s name is not proof of legitimacy.
Focus on the action requested, its consistency with normal behaviour and the independent evidence available. An email can look professional and still direct you to a convincing fake login page.
8. Apply the same checks to QR codes
A QR code moves a destination out of plain sight. Treat an unexpected code asking you to sign in or pay with the same caution as a link. Opening it on a phone does not make it more trustworthy than opening an email button on a laptop.
If the message claims to come from your employer or provider, use the known internal portal or official app. ReviewStreet’s report on QR code detection in security tools provides context, but no individual product replaces verification.
9. Report the message through the appropriate channel
Use your email service’s phishing-report option or your employer’s security process. Do not forward suspicious attachments casually to colleagues. If your organisation needs a sample, follow its instructions for preserving evidence.
After reporting, remove the message according to the applicable process. Reporting helps the relevant team investigate, while deletion alone does not tell them that a broader campaign may be reaching other people.
What to do if you already clicked
- Stop interacting with the page and do not provide further information.
- If you entered a password, change it through the genuine service from a trusted device and review available session and recovery controls.
- If banking details or a payment were involved, contact the provider immediately through an official channel.
- If you downloaded or ran a file, inform your IT team promptly or seek qualified security help and follow the provider’s recovery advice.
- Keep useful evidence such as the message and transaction details without spreading the suspicious content.
The response depends on what happened: opening a message, visiting a page, entering credentials and running a file are different events. Avoid assuming either that nothing happened or that every account is compromised. For reporting cybercrime in India, use the official National Cyber Crime Reporting Portal.
A safer response to common email requests
| Email claim | Safer next step |
|---|---|
| Your subscription payment failed | Open the known official app independently |
| A supplier changed bank details | Verify through a previously trusted contact |
| A document requires a new application | Check with the sender or IT team separately |
| A QR code is needed to restore access | Use the established account portal instead |
FAQs about phishing emails
Can a phishing email come from a real account?
Yes. A compromised account can send fraudulent requests. Verify unusual actions independently even when the sender appears familiar.
Is an email safe if its link uses HTTPS?
No. HTTPS protects the connection to a website; it does not establish that the website belongs to the business named in an email.
Should I reply to ask whether the email is real?
Use a separate trusted channel instead. A reply may simply reach the person controlling the suspicious account or address.
Does clicking a link always mean my password was stolen?
No, but it needs appropriate attention. What you entered, downloaded or approved matters. Follow the service’s recovery advice and seek help promptly where needed.
Source and scope
This guide draws on Microsoft’s official phishing guidance. It is general awareness information rather than an investigation of a particular message. Follow your employer’s incident-response process when workplace systems are involved.