Phishing emails try to get you to click a link, open an attachment, enter a password, or send money. They usually look like they come from someone you trust: your bank, Microsoft, a vendor, or even your own boss.
Signs to slow down
- Urgency or pressure. "Your account will be closed today." "I need this wire sent before noon." The pressure is the point: it keeps you from checking.
- A sender that doesn't quite match. The display name says your vendor, but the address is a free email account or a domain that's one letter off.
- Links that go somewhere else. On a computer, hover over a link before clicking and check where it actually goes. On a phone, press and hold to preview it.
- Unexpected attachments, especially invoices, shared documents, or voicemail notices you weren't expecting.
- Requests to change payment details or buy gift cards. Real vendors and managers rarely ask for this by email, and when they do, it's worth a phone call.
- A sign-in page you reached from an email. If an email says you need to sign in, go to the site directly instead of using the link.
Verify by phone, not by reply
If a request involves money, passwords, or sensitive data, confirm it with a phone call to a number you already have. Don't use the phone number in the email, and don't reply to it: if the sender's account has been taken over, the attacker is the one who answers.
If you already clicked
It happens. What matters is speed.
- Tell your IT contact right away, even if nothing seemed to happen.
- If you entered a password, change it now from a device you trust, along with anywhere else you've used the same password.
- If you opened an attachment or ran a program, disconnect the computer from Wi-Fi or unplug its network cable, and stop using it until IT has checked it.
- If money was sent, call your bank immediately. The sooner they know, the better the chance of stopping the transfer.
Reporting a phishing email you didn't fall for helps too. It lets IT warn everyone else and block the sender.