Workplace Productivity HubIndependent education
Workplace Security

Recognizing Phishing Emails: Warning Signs and Safe Responses

Learn the common signals of phishing and business email compromise, how to verify suspicious requests, and what to do if you have already clicked.

9 min readWorkplace Productivity Hub

Phishing is a fraud technique in which an attacker pretends to be a trusted person or organization to trick you into revealing credentials, installing malware, or sending money. It remains one of the most common ways workplace accounts are compromised. Attackers rely on urgency and trust, not on technical wizardry, which means careful habits are an effective defense.

Common types

  • Credential phishing: a message sends you to a fake login page to capture your username and password.
  • Business email compromise (BEC): an attacker impersonates an executive, vendor, or colleague and requests a payment or a change in bank details.
  • Malicious attachments: documents or archives that install malware when opened or when macros or content are enabled.
  • Fake document-sharing notifications: messages that look like a shared file invitation but lead to a counterfeit sign-in page.
  • Text-message and phone scams: the same tactics via SMS ("smishing") or voice calls ("vishing"), including calls claiming to be from technical support.

Warning signs

Pressure and urgency

"Your account will be closed in 24 hours." "Wire the payment today and do not discuss it." Urgency is designed to prevent you from thinking and verifying.

Mismatched sender details

The display name says "Alex Rivera, CEO," but the actual address is from a free email service or a domain that is one letter off from the real one. On mobile devices, tap the sender name to see the full address.

Unexpected requests

Requests involving money, gift cards, payroll changes, or confidential information, especially if they bypass normal procedures, deserve extra scrutiny.

Suspicious links

Hover over a link (or press and hold on a phone) to preview the destination before clicking. Watch for misspelled domains or unrelated addresses. Be aware that legitimate-looking text can hide a different target.

Odd attachments

Be wary of unexpected invoices, voicemail files, or zipped archives, and of documents that ask you to enable macros or editing to view content.

Generic greetings and writing quirks

"Dear customer" and unusual phrasing can be clues, though well-written phishing is increasingly common, so absence of typos is not proof of legitimacy.

Step-by-step: what to do with a suspicious message

  1. Do not click, reply, or open attachments.
  2. Verify through another channel. Call the sender using a phone number you already have, not one in the message. Or go directly to the website by typing the address yourself.
  3. Check with a colleague or your IT contact if you are unsure.
  4. Report it. Use your email client's "Report phishing" option if available, and inform your team so others do not fall for it.
  5. Delete it after reporting.

If you already clicked or entered credentials

  1. Disconnect the device from the network if you opened a suspicious attachment.
  2. Change the password for the affected account from a different, trusted device, and for any other account that used the same password.
  3. Enable or review multi-factor authentication and sign out all other sessions if the service allows.
  4. Notify your manager or IT contact immediately. Speed matters, and reporting quickly is not something to be embarrassed about.
  5. Check for forwarding rules in your mailbox settings; attackers sometimes create hidden rules that forward or hide messages.
  6. Monitor accounts for unusual activity, including financial accounts if relevant.

Procedures that prevent payment fraud

  • Require a second approval for payments over a defined amount.
  • Verify any change in vendor banking details by calling a known number.
  • Never buy gift cards or send cryptocurrency at the request of an email, even from someone who appears to be your boss.
  • Keep a list of authorized contacts at key vendors.

Training your team

Short, regular training is more effective than a once-a-year lecture. Share real examples (with sensitive details removed), encourage questions, and make reporting easy and blame-free. Consider occasional simulated phishing exercises if your organization has the resources, and treat the results as learning rather than punishment.

Advantages and limitations

Advantages of these habits

  • Cost nothing and apply to any email system.
  • Protect against a wide range of scams, including new ones.
  • Reduce financial and reputational risk.

Limitations

  • Human attention is imperfect, so combine with technical measures such as MFA and filtering.
  • Sophisticated attacks can be convincing even to careful readers.
Resources: The U.S. Federal Trade Commission (ftc.gov) and the Cybersecurity and Infrastructure Security Agency (cisa.gov) publish free guidance on recognizing and reporting phishing and other scams.

Conclusion

Slow down, verify through a second channel, and report quickly. No single warning sign proves a message is fraudulent, but pressure plus an unusual request is reason enough to double-check. Continue with the Workplace Security Checklist for Small Teams to put the full set of protections in place.

Independent and educational. This article is general information, not professional, legal, or technical-support advice. Workplace Productivity Hub is not affiliated with any software vendor. Features, menu names, and limits vary by product and plan and change over time, so confirm details in your own tools' official documentation. See our editorial standards and corrections policy.