A few years ago one of our accounts people forwarded me an email with the subject “Invoice #INV-90214 overdue – action required”. It looked exactly like the vendor we actually used. Same logo, same footer, same signature block. The only thing that was wrong was one character in the sending domain.
That is what modern phishing looks like. Not broken English and a Nigerian prince, but a well-designed email that arrives on a Tuesday afternoon when you are already behind on three things. Here is the checklist I actually use, and the one I teach teams to use.
1. Read the domain, not the display name
The display name in an email client is free text. Anyone can set it to “Microsoft 365” or “HR Department” or your CEO’s full name. It proves nothing. The only part that matters is what comes after the @ symbol, and you have to read it character by character.
Attackers rely on the fact that your brain reads word shapes, not letters. These are all real patterns I have seen:
- Character swaps: rn instead of m (modern.com vs modern.com is hard to see at 11px), 1 instead of l, 0 instead of o.
- Subdomain tricks: paypal.security-verify.com. The real domain is security-verify.com. PayPal is just a subdomain the attacker owns.
- Extra words: microsoft-support.com, google-drive-share.net. Big companies do not buy hyphenated lookalike domains for transactional mail.
- Different TLD: yourcompany.co instead of yourcompany.com.
Practical habit: on desktop, hover and read the raw address. On mobile, tap the sender name to expand it. If you are on a phone and cannot easily see the full address, that alone is a reason to wait until you are at a laptop.
2. Ask what the email wants you to do in the next five minutes
Almost every phishing email has one of four asks: click a link, open an attachment, reply with information, or move money. Legitimate email usually has a much wider range of purposes – it informs, it confirms, it schedules, it says thanks.
So before you assess whether the email looks real, ask what it is pushing you toward. Then apply pressure-testing:
- Urgency plus consequence. “Your account will be suspended in 24 hours.” “Payment must be processed today or the shipment is held.” Real vendors send reminders. They rarely send ultimatums by email.
- Secrecy. “Do not discuss this with the team yet.” This is the signature of CEO-fraud / business email compromise. No legitimate internal request needs you to bypass your own colleagues.
- A change to payment details. A vendor emailing you new bank details is the single highest-risk email your finance inbox will ever receive. Treat every one of them as fraudulent until confirmed by phone on a number you already had – not the number in the email.
3. Inspect links without clicking them
Hover over a link and your client shows the real destination in the status bar or a tooltip. The visible text can say anything, including a full URL that is not the actual href. This is trivial to fake in HTML email:
- Look at what comes immediately before the first single slash after the domain. That is the real host. Everything after it – the long path, the query string, the token – is decoration.
- Be suspicious of link shorteners in business email. Bit.ly links hide the destination by design. A vendor invoice does not need one.
- Watch for legitimate services used as a hop: a Google Doc, a Dropbox file, a DocuSign-styled page that then asks you to “sign in with your email password to view”. The hosting is real. The login form is not.
- If you have already clicked and landed on a login page, stop and check the address bar before typing anything. That is your last checkpoint, and it works.
A rule that has saved me more than once: never log in via a link in an email. If Microsoft says your mailbox is full, close the email, open a new tab, and go to the service directly. It costs fifteen seconds.
4. Notice the things that are missing
Phishing emails are usually written to a broad list, so they lack the specifics a real message would carry. When you are unsure, look for absence rather than presence:
- No account-specific detail. Real invoices reference a PO number, a project name, an order date. “Dear Customer, please find your invoice attached” references nothing.
- No thread history. A vendor you have emailed for two years suddenly starts a brand new thread with no prior context.
- Reply-To differs from From. This field is visible if you expand headers, and a mismatch is a strong signal – the attacker wants your reply to go somewhere else.
- Odd attachment types. .html, .htm, .iso, .img, .zip containing a single .exe, or an Office file that immediately asks you to “Enable Content”. Macros are how a document becomes code.
5. Build the process, not just the awareness
Individual vigilance fails eventually, because people are tired and busy and phishing only has to work once. What actually reduces risk is process. The things worth putting in place, roughly in order of return on effort:
- MFA on everything, especially email. It turns a stolen password from a breach into an inconvenience. Prefer an authenticator app or hardware key over SMS.
- A two-person rule for payments above a threshold, and a mandatory callback for any change to bank details. Write it down so nobody has to make a judgement call under pressure.
- A no-blame reporting channel. If reporting a click gets someone in trouble, they will hide it, and you lose the hours that matter most. Make “I think I clicked something” a completely safe sentence to say.
- SPF, DKIM and DMARC configured on your own domain, so attackers cannot cheaply spoof your company to your own staff and customers. This is a one-afternoon DNS job that most small companies never do.
- External sender banners. A visible tag on mail from outside the organisation is a small change that kills a large share of CEO-fraud attempts.
If you think you clicked
Speed matters more than embarrassment. Disconnect from the network if you ran an attachment, change the password from a different device, revoke active sessions and app passwords for that account, turn on MFA if it was not on, and tell whoever handles IT immediately. Then check mailbox rules – attackers commonly add a hidden forwarding or auto-delete rule so you never see the replies to their fraud.
The takeaway
You do not need to be a security specialist to catch phishing. You need three habits: read the actual domain, ask what the email wants you to do, and never authenticate through a link in an email. Then put a callback rule around money movement, because the expensive attacks are the ones that target your finance process, not your firewall.
The email that fooled our accounts team was caught by a phone call, not by software. That is usually how it goes.
