How to Spot Phishing: 8 Warning Signs in Business Emails

You can reliably spot phishing by eight signs: a sender address that only looks right at first glance; artificial time pressure; unusual requests for payments or data; links whose real destination differs from the text; unexpected attachments; a greeting that doesn't fit; a switch away from the usual channel of communication; and a request to bypass the normal approval process.

No single sign is proof on its own. Two of them at once are reason enough to pick up the phone before anyone clicks anything.

The eight warning signs in detail

1. The sender address is almost right

The name of a familiar contact is displayed, but a different address sits behind it. Popular tricks are swapped letters, extra hyphens or a different domain ending, such as supplier-inc.com instead of supplier.com, or a capital I in place of a lowercase l. When in doubt, check the full address, not just the display name.

2. Urgency as a lever

"By the end of today", "final reminder", "your account will be blocked", "before the boss gets back". Time pressure is the most important tool in phishing because it stops people from thinking. Reputable business partners don't give you two hours to make a payment.

3. New bank details

The B2B classic: an invoice from a known supplier arrives, everything looks familiar, only the IBAN is new, "because we've switched banks". This scam costs businesses substantial sums every year. The rule: every change to bank details is confirmed by phone, using a number from your own records and never one from the email.

4. The link goes somewhere else

The visible text shows a familiar address, but the actual destination is different. On a computer, hover over the link without clicking and the real address appears in the bottom corner of your browser or mail program. On a phone, a long press does the same.

5. An unexpected attachment

Especially with file types that can be executed, or Office files that ask you to enable macros. An invoice you weren't expecting, from a sender you have no dealings with, is not a mistake. It's the attack.

6. The greeting doesn't fit

Either too generic ("Dear customer") from a sender who should know your name, or strikingly familiar from someone who has never addressed you that way. Both suggest the sender isn't who they claim to be.

7. The channel changes

"Please reply to this private address, I can't get into my work inbox right now." Or a request to continue on WhatsApp. Anyone pushing you out of the traceable, documented channel has a reason for doing so.

8. You're asked to skip the approval process

The most dangerous variant, because it needs no technical tricks at all: an email, apparently from senior management, asks someone in accounting for a quick, confidential transfer, please without the usual two-person check. This scam is called CEO fraud, and unfortunately it works again and again.

What technology can handle and what it can’t

Professional email protection filters out a large share of attacks before they ever reach the inbox: known sender addresses from attack campaigns, suspicious attachments, links to reported sites. On top of that, modern systems check links at the moment you click, because many malicious pages only go live after the email has been delivered.

What technology won't catch: a well-written email from a real supplier's genuine but hijacked mailbox, with a plausible invoice and a new IBAN. Only a solid process helps here.

If someone did click

The order matters, and so does making sure nobody stays quiet out of embarrassment:

1. Disconnect the device from the network, but don't switch it off. Turn off Wi-Fi, unplug the network cable.
2. Report it immediately, internally and to your IT provider. Every minute counts.
3. Change passwords, from a different, clean device.
4. If money was sent: call the bank. Transfers can sometimes still be stopped if you act quickly.
5. Document the incident. Screenshots, the time, affected accounts. You'll need this for insurance, a police report and any reporting obligations.

A workplace culture where a wrong click is reported right away instead of hushed up is worth more for security than any extra filtering product.

What you can put in place with reasonable effort

• Multi-factor authentication for every mailbox. It prevents an account takeover even if the password has been stolen.
• Flag external senders. An automatic notice above every email from outside the company exposes fake internal senders instantly.
• Set up SPF, DKIM and DMARC for your own domain so that nobody else can send emails in your name.
• Short refreshers for the team, twice a year, using real examples from your own inbox rather than generic slides.

Frequently asked questions

How can you tell a phishing email?

By a sender address that only looks similar, artificial time pressure, unusual requests for payments or data, links whose destination doesn't match the text, unexpected attachments, an odd greeting, a switch to a different communication channel and a request to skip the usual approval process.

What is CEO fraud?

In CEO fraud, attackers pose as senior management by email and ask someone in accounting for an urgent, confidential transfer that bypasses the usual approval. The attack doesn't exploit any technical weakness; it relies on authority and time pressure.

What should you do if you've clicked on a phishing email?

Disconnect the device from the network immediately, but don't switch it off. Report the incident right away, internally and to your IT provider. Change passwords from a clean device. If a payment was triggered, call the bank at once. Document everything.

How do you protect yourself against fake invoices with changed bank details?

With a fixed written rule: every change to bank details is confirmed by phone, using a number from your own records and never a number taken from the email in question.