How do I spot a phishing email?
Treat any email as suspect if it pushes urgency, asks you to sign in, pay, or change bank details, or comes from a slightly wrong address. Never use its links or phone numbers. Check by typing the website address yourself or calling a number you already have. Perfect grammar is no longer a sign of safety.
The short version
- Watch for urgency, sign-in requests, payment changes and addresses that are nearly right.
- Never act on a link or phone number inside a suspicious message.
- Check by going to the site yourself or calling a number you already know.
- If you clicked and typed a password, change it from a trusted device now.
What are the warning signs?
Phishing emails try to get a password, a payment or a click on a harmful file. CISA’s phishing guidance lists the main signs, and they match what small businesses see:
- Urgency or fear. “Your mailbox will be closed today.” “Final notice: payment overdue.”
- A request to sign in. A link to “verify” your Microsoft, Google, bank or domain account.
- A change of payment details. A supplier suddenly has a new bank account.
- An address or link that’s slightly wrong, such as a letter swapped in the domain or a free email account with a familiar name.
- Unexpected attachments, often invoices, shipping notices or shared documents.
- Short links you can’t read.
CISA also warns that clean spelling and grammar don’t prove anything anymore, because AI tools can write a flawless message.
What’s the one habit that stops most phishing?
Don’t use anything inside the message to check it. Instead:
- Type the website address yourself, or use a bookmark.
- Call the person on a number you already have, not one in the email.
- Ask a colleague before paying anything unusual.
This works however convincing the email looks, because it takes the scammer’s links out of the loop.
Why does it matter?
In a small business, one person often handles email, money and the website. A single stolen password can expose all three. Fake payment requests can also reach your customers if your mailbox is taken over. See what to do if someone is sending email as you.
What are the common mistakes and edge cases?
- Trusting the display name. “Your Bank” can sit on top of any address. Check the address itself.
- Clicking “unsubscribe” in a scam. CISA advises deleting rather than replying or clicking anything.
- Typing a password into a pop-up from an email. Only sign in on a page you opened yourself. See why Outlook keeps asking for my password for the real prompts.
- Assuming a text or phone call is safer. The same tricks arrive by SMS and voice.
What if I already clicked?
- If you typed a password, change it from a trusted device, and anywhere else you used it.
- Turn on two-step sign-in. See two-factor authentication.
- Tell whoever manages your email so they can check sign-ins and rules.
- If money was sent, call your bank immediately.
- Report the message with the “report phishing” or “report spam” option in your email, then delete it.
How much does it cost, and how long does it take?
The habits are free. Two-step sign-in and a password manager take an afternoon to set up for a small team. See how to manage business passwords.
How does E-3 handle this?
Not sure about a message? Forward it to support@e3help.me; replies usually come within one business day. If money or a password is involved, phone 814-399-4655 instead.
Related questions
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.