How to Spot a Phishing Email Before You Click

Phishing emails are designed to make you panic, click quickly or trust a familiar name. Here is a simple guide your team can use before opening links, attachments or payment requests.

1. The urgent password reset

This is one of the oldest phishing tricks. The email claims your Microsoft, Google, banking or business account will be suspended unless you verify your identity immediately.

Red flags to look for

• Look-alike sender domains: attackers often use addresses that look close to the real one, such as extra hyphens, misspellings or unusual domain endings.
• Artificial urgency: phrases like “urgent”, “account suspended” or “24 hours left” are designed to stop you thinking clearly.
• Generic greetings: “Dear Customer” or “Dear Employee” can be a warning sign, especially for services that normally know your name.
• Hidden link destinations: a button may look safe while actually pointing to a fake login page.

Safer action: do not use the button in the email. Open your browser or app manually and sign in from the known official address.

2. The fake invoice or delivery notice

Fake invoices target accounts teams, owners and busy staff who may be worried about late fees or an unexpected charge. The dangerous part is often the attachment.

Red flags to look for

• Suspicious file extensions: a file called Invoice.pdf.exe is not a PDF. It is a program and may install malware.
• Unexpected compressed files: be careful with surprise .zip files or macro-enabled documents such as .docm.
• Vague details: the email does not explain what was bought, who ordered it or which company it relates to.
• Unknown vendors: if you do not recognise the supplier, do not open attachments just to investigate.

Safer action: confirm the invoice using a known phone number or supplier portal before opening attachments or making payment.

3. The “spoofed boss” request

Also called CEO fraud or business email compromise, this scam impersonates a manager, director or owner. The message usually asks for a quick favour while claiming the person is in a meeting and cannot take calls.

Red flags to look for

• The display name is not enough: the sender may display your boss’s name while using a Gmail or other outside address.
• They discourage a phone call: scammers often say they are busy, travelling or in a meeting so you will not verify the request.
• Gift cards or urgent transfers: no normal business process should require Apple, iTunes, Amazon or similar gift card codes.
• Unusual payment behaviour: new bank details, urgent beneficiary changes or secret payments should always be verified.

Safer action: call the person on a known number, not the number in the suspicious email, before sending money, codes or sensitive information.

The 5 golden rules of phishing defence

1. Stop and breathe. Phishing relies on panic and urgency.
2. Check the sender. Expand the “From” address and inspect the actual email address, not only the display name.
3. Hover before clicking. On a computer, hover over links to preview the destination before opening them.
4. Verify independently. Use a known phone number, official app or saved website link to confirm unusual requests.
5. Report it. Do not just delete suspicious email. Report it to your IT support so other users can be protected too.

What to do if you already clicked

If you clicked a suspicious link or opened an attachment, act quickly:

• Do not enter your password on the suspicious page.
• Disconnect from the internet if you opened a suspicious attachment.
• Change your password from a trusted device if you typed it into a fake page.
• Enable multi-factor authentication where possible.
• Contact IT support so the device and mailbox can be checked.

Small businesses are common targets

Phishing is not only a large-company problem. Small businesses, farms and local teams often depend on the same email accounts for invoicing, supplier communication, banking and customer contact. One compromised mailbox can quickly lead to stolen data, fake payments or malware.

Gigatech can help with endpoint protection, managed IT support, backup planning and practical user awareness for businesses around Christiana and the Vaal River region.