Phishing: How to Spot a Scam Email Before You Click

What phishing is

Phishing is a fake message, usually email, designed to trick you into clicking a bad link, opening a malicious attachment, or handing over a password. It is the most common way businesses get breached, and it works because the messages look real.

The warning signs

• A sense of urgency: "act now," "your account will be closed," "payment overdue"
• A mismatched sender: the display name looks right but the actual address is off
• Links that do not match: hover over a link and the destination is a strange address
• Unexpected attachments, especially invoices or shipping notices you were not expecting
• Requests for credentials or payment, or a change to bank details

Check before you click

Slow down. Hover over links to see where they really go. If a message claims to be from your bank, a vendor, or a coworker and something feels off, contact them through a number or address you already trust, not the one in the email.

If you already clicked

It happens. The important thing is to act fast: disconnect the device, change the password for any account you entered, turn on multi-factor authentication if it is not already on, and tell whoever handles your IT so they can check for damage.