Phishing emails used to be easy to spot, full of spelling mistakes and unlikely stories. Not anymore. Today’s attackers use clean design, real logos and even AI-written text. Still, almost every phishing message leaves clues. Share these ten warning signs with your team.
1. A sense of urgency
“Your account will be suspended in 24 hours.” “Payment overdue — act now.” Pressure is the phisher’s favourite tool, because people who rush don’t stop to think.
2. A sender address that doesn’t quite match
The display name says “Microsoft Support” or your CEO’s name, but the actual address is something like [email protected]. Always check the full address, not just the name.
3. Look-alike domains
Attackers register domains that differ by a single character: yourcompamy.com instead of yourcompany.com, or rn in place of m. These are easy to miss on a phone screen.
4. Links that go somewhere unexpected
Hover over a link (or long-press on mobile) before clicking. If the text says one website but the real destination is another, treat it as suspicious.
5. Requests for passwords or codes
Legitimate IT teams and service providers never ask you to send your password or a two-factor code by email. Anyone who does is almost certainly an attacker.
6. Unexpected attachments
Invoices you weren’t expecting, “scanned documents” and voicemail files are classic malware carriers. If in doubt, confirm with the sender by phone.
7. Changes to payment details
An email announcing new bank details for a supplier is one of the most expensive scams in business. Always verify through a known phone number before changing payment information.
8. Generic greetings
“Dear customer” or “Dear user” from a company that knows your name is a red flag, though targeted attacks may use your real name.
9. Too good to be true
Prizes, refunds, gift cards and surprise bonuses are bait. If you didn’t enter a competition, you didn’t win it.
10. Something just feels off
An unusual tone from a colleague, a request outside normal procedure, or a message at an odd hour. Trust your instincts and verify.
What to do if you spot one
1. Don’t click links, open attachments or reply.
2. Report it to your IT team or use the report option in your mail client.
3. Delete it once reported.
4. If you already clicked or entered a password, tell IT immediately and change your password from a safe device.
Let technology catch what people miss
Even well-trained staff make mistakes when they’re busy. That’s why the first line of defence should stop phishing before it reaches anyone. AI-driven filtering looks beyond keywords to analyse sender behaviour, message structure and intent, catching new campaigns that rule-based filters miss. Two-factor authentication then acts as a safety net: even if a password is stolen, the attacker can’t log in.
How Smardove protects against phishing
Smardove’s AI-driven antispam engine, powered by SpamFoo, learns continuously from real mail flow and user feedback to identify phishing attempts. Combined with virus scanning, two-factor authentication and country-based login restrictions, it keeps phishing out of inboxes and stolen passwords out of attackers’ hands.
| Stop phishing at the door. Talk to Smardove about secure hosted email for your business. |
