Phishing emails: 7 signs to check before you click
How to tell if an email is phishing: seven signs to check before you click, and what to do if you already clicked or paid.
Ward Security Team
· 6 min read
A suspicious email is a small decision that can cost a lot. One click can hand a criminal your mailbox, and one payment can send money to the wrong account. In 2024, phishing and spoofing was the most reported crime in the United States, with about 193,400 complaints to the FBI's Internet Crime Complaint Center (IC3). Most of those messages were built to look ordinary.
What is a phishing email, and why does it matter to my business?
Phishing is a message that tries to trick you into clicking a link, sharing a password or code, opening a file, or paying someone. It often pretends to be a bank, a supplier, a service you use, or a colleague. For a small business, one click can lead to a takeover of the mailbox, and one payment can be hard to recover.
What are the seven signs to check?
Check them in order before you click, reply or pay. You do not need to be an expert. You need to pause.
Does the sender's address match the name?
Look at the full address, not only the name shown. A name like "Billing Team" can sit on any address, including billing@yourc0mpany.com. A lookalike domain is one of the most common tricks, and it is easy to miss on a phone.
Does it rush you?
Urgency is a classic sign. Messages say "pay today" or "your account will close" so you do not stop to check. A real supplier can wait for a phone call.
Does it use your name and your real details?
A greeting like "Dear customer", or a message with no detail about your account, is a sign. Some scams are written well, so this sign never works alone.
Does it ask about money or bank details?
A new account, a changed payment method, a gift card or a payment you did not expect are all reasons to stop. Confirm the request by calling a number you already had. The fake invoice scam depends on this step.
Does it ask for a password, a code or a sign-in?
A message that asks you to verify your account, confirm a login or enter a code is a common trick. A legitimate service rarely needs your password by email. Go to the site yourself, by typing its address or using a bookmark you saved, and check there.
Do the links go where the text says?
On a computer, hover over a link to see its real address. On a phone, press and hold it. If the text names one company and the address points to another, stop. Shortened links hide the destination, so treat them with extra care.
Did you expect this attachment?
An attachment you did not ask for is a warning, especially a password-protected zip file, an Office file that asks you to enable macros, or a file with two extensions, such as invoice.pdf.exe. Do not open it. Ask the sender another way.
What if I still can't tell?
Do not guess. Stop, and check through another channel, using a number or address you already had. You can also use Ward Analyzer, which checks an email, a link or a file for you without running it or visiting its links.
For an email, paste the original message or upload the .eml file. For a link, paste the address. For a file, drop it in. Ward looks at the sender's authentication (SPF, DKIM and DMARC), lookalike domains, the age of the domains, the links, any attachments and the wording. Then it gives one of four verdicts: Dangerous, Suspicious, Inconclusive, or Looks legitimate.
Forward an email as an attachment, not as plain text. A normal forward can lose the original headers, and the sender's proof is in those headers.
billing@yourc0mpany.com
SuspiciousInvoice overdue, pay today
What Ward found
- The domain imitates yours (yourc0mpany.com).
- Asks to change bank details
- Pushes you to act in a hurry
- Asks you to sign in or verify an account
Links: shown deactivated. Ward never visits them.
What to do. Don't click or open anything until the sender confirms it through another channel, such as a phone call.
Two details matter. Ward never says a message is safe, so the mildest verdict only means no warning signs were found. And Analyzer is part of Ward's paid plans, with a monthly limit on analyses.
What should I do if I already clicked?
Act now. Start with the account the link asked you to use.
- Change that password, then change it on every other account where you used the same one.
- Turn on multi-factor sign-in for your mailbox and for the accounts that matter most to the business.
- Check the mailbox for rules you did not create, such as forwarding or hidden filters, and remove them.
- Run the security software you already use on the device, and install the pending updates.
- Tell the person who manages your accounts, and warn your team.
What should I do if I already paid?
Call your bank right away, on a number you already trust, and ask them to stop or recall the payment. Then follow the steps in the fake invoice scam, including reporting it at ic3.gov if you are in the United States.
How do I train my team without scaring them?
Make checking normal, not frightening. Three habits do most of the work.
- Pause before any money or password request. A short pause is always acceptable, even to a manager.
- Confirm through a second channel, using a number you already had.
- Make reporting easy, and thank people who report, even when it was a false alarm.
Your team will catch more scams if they feel safe asking a question than if they are afraid of getting one wrong.
Is there a quick checklist I can keep?
Use this table when a message makes you hesitate. Read the first column, look for the sign in the message, and do the action in the last column.
| Sign | What to look for | What to do |
|---|---|---|
| 1. Sender address | A name that does not match the address, or a lookalike domain | Check the full address, and verify through a known number |
| 2. Pressure | "Pay today," "account closed," "act now" | Stop, and take the time to check |
| 3. Greeting | "Dear customer" or no detail about your account | Treat it as a weak sign, and look for others |
| 4. Money or bank details | A new account, a gift card or an unexpected payment | Call a number you already had before you pay |
| 5. Sign-in or password | A request to verify an account or enter a code | Go to the site yourself, by typing its address |
| 6. Links | Text that names one place while the address points to another | Hover or press and hold to see the real address; do not click |
| 7. Attachments | A file you did not expect, a zip with a password, or macros | Do not open it; ask the sender another way |
How do I protect my own email from being used to fool customers?
Make sure no one can send email as your domain. Publish a DMARC record and read its reports. The DMARC guide for small businesses walks through the steps, and our guide to email spoofing explains the reasons behind them.
The simplest rule is the one that stops the most damage. When a message asks for money, a password or a change, stop and check it another way.
Frequently asked questions
- What is phishing?
- A message that tries to trick you into a click, a password, a payment or a download, usually by pretending to be someone you trust.
- Is one suspicious sign enough to call an email a scam?
- No. One sign can be a mistake. Several signs together are a reason to stop and check through another channel.
- Should I click the link to check whether it is safe?
- No. On a computer, hover over the link to see its address. For a closer look, use Ward Analyzer, which reads the link without visiting it.
- What should I do if I already clicked and entered my password?
- Change the password on that account right away, and on any account that used the same password. Turn on multi-factor sign-in.
- Can Ward tell me whether an email is a scam?
- Ward Analyzer reads a pasted or uploaded email and gives one of four verdicts, with the reasons. It never says a message is safe. It is part of Ward's paid plans.